MALICIOUS — 2f1e433e02e822beba059571d22b7bc47d40020298161b08ffa2e6800f17a4b7

MALICIOUS — 2f1e433e02e822beba059571d22b7bc47d40020298161b08ffa2e6800f17a4b7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2f1e433e02e822beba059571d22b7bc47d40020298161b08ffa2e6800f17a4b7
SHA-1: d58fc0ed5e0b8df851cd8960ee662594ebae2480
MD5: 65048eb6e3ffc27c27d7ca347e3370bc
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dUBgdnVgE1KXHHMpKsuqGhlOZBpbCfT8xTDC6:Qoa1taC070dtRyEcXMgIp+se5SmN9C
TLSH: T1A45A235A5519770CE2F6C4847C29262DD482D4F6A73C29CA828FF08D73CB6A778211DB
Submitted as: 2f1e433e02e822beba059571d22b7bc47d40020298161b08ffa2e6800f17a4b7
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\D915.tmp - 07c625738d0d34e21bc94d75cb7bb1b5cba9e138992d0e863b09b52883a0de50
11c0c784cb48f26d80dbc41fba20c496f32d53f94ca731c7d81ab793290b4eb1 - 11c0c784cb48f26d80dbc41fba20c496f32d53f94ca731c7d81ab793290b4eb1

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787917593&P2=404&P3=2&P4=gUoKquFMPisqfmfuu%2fmK1hzV5mdSZFLzh04iPAKFM5WDZ34YIkrDWXT7edBub%2fsr5mEhaPfwkTXbDZLjnVi7%2fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787917648&P2=404&P3=2&P4=bkqKgTH5R0vwnfEFB%2f19yxuCkY2UfNnAz1I%2f7ZjeyO2RkRD6y22zSmNYEmfp6GPsTfGcUW1uR4aUH%2fJbRw5SEg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

0.co
schemas.microsoft.com

Embedded IP addresses

20.89.1.9
4.144.132.114
172.215.188.225
4.230.171.124
74.178.76.128
4.150.223.110
74.178.240.51
20.236.44.162
52.123.129.14
52.123.128.14
20.42.73.26
135.234.160.244
203.26.79.13
52.123.252.232
74.178.232.29
52.148.114.188
92.223.78.30
4.150.223.111
52.168.117.168
72.154.7.104
52.110.12.20
52.110.12.2

File paths

H:\(d

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report