MALICIOUS — 2791fb3cb9c33444ab306d0a854138c1cdde4e4deb3c48692e6b1476f850c2da

MALICIOUS — 2791fb3cb9c33444ab306d0a854138c1cdde4e4deb3c48692e6b1476f850c2da is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salgorea family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 2791fb3cb9c33444ab306d0a854138c1cdde4e4deb3c48692e6b1476f850c2da
SHA-1: eb5ff00e240291b67ed96de0b6a4d62fd94a342f
MD5: 0616a92020c43b02e802106f6f623d20
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF4E1vSEgX72Yg0yGWIYpDi8JkgPDWhyGc:O+K88uPCH6GvuLZRy/pHiQDYyGc
TLSH: T14E5A23859A2A474DE3F2D540291A3BBDC941F4D6877C088A438FF11E23DB967783219B
Submitted as: 2791fb3cb9c33444ab306d0a854138c1cdde4e4deb3c48692e6b1476f850c2da
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Salgorea

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12889 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_05dd610788a94538.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\114.tmp - e54e26aa58149bc66be22ef7df168400f5cfc898caff1802ec52e3df6845548d
e41aea13545f432140deb8ee2d50da591715ad7b81afd84fcb1483c78a3a28de - e41aea13545f432140deb8ee2d50da591715ad7b81afd84fcb1483c78a3a28de

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

oy.nl
364.fr
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.111
52.123.252.241
4.230.171.124
20.42.179.192
20.247.184.197
135.232.92.97
4.150.223.113
135.232.92.137
20.184.175.5
40.79.163.155
4.150.223.108
172.66.2.5
172.215.188.225
20.42.179.204
172.178.240.162
72.154.7.114
52.148.114.188
52.110.12.1
52.110.12.45

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report