MALICIOUS — 28975a00f40a1ee8c2457ded966e350cf4a3e34d1dc0eee92c51efb38b46678f

MALICIOUS — 28975a00f40a1ee8c2457ded966e350cf4a3e34d1dc0eee92c51efb38b46678f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 28975a00f40a1ee8c2457ded966e350cf4a3e34d1dc0eee92c51efb38b46678f
SHA-1: 484c7e09cf8f64624075b87b1a52de94bed6d969
MD5: 337e532b7a0eb00401b28cf200e38a0b
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070daA93KVLHI/qVe69H3GQ2iK:Qoa1taC0rs69oyVea3FK
TLSH: T1965A23495314A70CE7F6C0802D6A127EC442D8F69778198A42CBF15EB3C7AAB7C115EB
Submitted as: 28975a00f40a1ee8c2457ded966e350cf4a3e34d1dc0eee92c51efb38b46678f
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\35C0.tmp - 59621fd747f5807f923b979ef1a78458be62d0cef9ec842573efe545859bdace
ae535dd7931a68c34b2db465eeabb6370435640c06e635a19f97520d2bedced5 - ae535dd7931a68c34b2db465eeabb6370435640c06e635a19f97520d2bedced5

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787940655&P2=404&P3=2&P4=Pa4snu3fiM13bxRMtYAWaRVfXteeCigVcDB4fq6BkdJY2VMgf1JxEoKeakwgLLyRJvqc5Aklwi7N5PY5gCF%2fkg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787940711&P2=404&P3=2&P4=CRFdmNsgoBJeerwxFa99OVfJCJcLCSJSdw1A9p1GkM8l7VX4YrM58W5PrpK5iyxVF1GNBcotcl5wbbApLP%2fNiA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.50.80.215
172.215.188.232
4.230.171.124
20.247.184.197
135.233.95.144
135.232.92.97
51.116.253.169
20.236.44.162
52.123.128.14
40.99.134.2
40.79.163.154
203.26.79.13
135.232.92.34
172.178.240.162
20.42.179.192
52.148.114.188
52.110.12.22
52.110.12.20
72.154.7.98
92.223.78.30
52.110.12.55
52.110.12.2

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report