MALICIOUS — 3097e8a3cd26dfa5fa13a4e794c296971cd1d98edb1eab2741aa25e1df353436

MALICIOUS — 3097e8a3cd26dfa5fa13a4e794c296971cd1d98edb1eab2741aa25e1df353436 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3097e8a3cd26dfa5fa13a4e794c296971cd1d98edb1eab2741aa25e1df353436
SHA-1: 8901cb585484d95103584bd519c191e1fe017b7d
MD5: f1451ce9965b6ff197a19d85a8dce543
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFzYr8VaVWp4a2OiQUxfsiGc36kgI+ZiyGc:O+K88uPCH38VW5nUhqqNv+UyGc
TLSH: T1015A23C99A298B0AF6F1C5402C2523BDC541F4E682B8098F528BF12E73DB977787115B
Submitted as: 3097e8a3cd26dfa5fa13a4e794c296971cd1d98edb1eab2741aa25e1df353436
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 34 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75

Dynamic analysis (windows)

5973 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_db9a8beb784641a8.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\9F53.tmp - dfdf9e54d8002e56f0b7e5b89573a5d2692f06cbd0b53a646015c21a659338fd
695687467bad867e7460336924ac8afaf02579c3a2142080ac702aaded38bb7c - 695687467bad867e7460336924ac8afaf02579c3a2142080ac702aaded38bb7c

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787764117&P2=404&P3=2&P4=NGl6DE3gQt2xuLUsmvnfh44DzCLlm9F%2f1ahIfx0LW4d%2bVjxDYKkZFhljfNbwhWky3lJuTFnf8EXibNEWwtECww%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787764151&P2=404&P3=2&P4=U0SzxCto7w96g%2fB6RgmI%2fRLYmRMgEovELijlPRonV1RanzzOov98ABn4ITW5iTfxWU4hhDcj2Sh6JYLv8b1%2fRw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.102
4.144.132.223
4.247.188.233
4.230.171.124
40.84.97.4
74.178.76.128
20.165.94.54
4.150.223.105
20.165.94.63
4.150.223.113
20.112.250.133
52.123.129.14
40.99.134.18
52.123.128.14
162.159.142.9
40.103.64.242
20.50.201.205
172.178.240.162
52.123.252.244
203.26.79.13
52.123.252.215
135.233.95.80
52.123.252.194
52.123.252.235
52.148.114.188

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report