MALICIOUS — 349ef897878a23e7ac4885799bae9e0b2e92ef5a9f87336a4535598e201e92c3

MALICIOUS — 349ef897878a23e7ac4885799bae9e0b2e92ef5a9f87336a4535598e201e92c3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 349ef897878a23e7ac4885799bae9e0b2e92ef5a9f87336a4535598e201e92c3
SHA-1: fa97b62b93ca5503dac6b2c15d123af3639fca43
MD5: 966c8a19d7dfadceb61d83ffb82996ca
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFXETOBNAwTmgLJVBE5Ewx6QCWSyGc:O+K88uPCHJETOBNL1dTE5X6QCWSyGc
TLSH: T12C5A23864A1A6B4CF3F6C5803819676F8482F8D297B809CA424FF11D73DB967743129B
Submitted as: 349ef897878a23e7ac4885799bae9e0b2e92ef5a9f87336a4535598e201e92c3
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\45AF.tmp - a1141a9ff7407d7bcd45860e14259219d599b37d7079608f043e4aabb1be978b
ea8e472e5432665b009f2b89a8b96e337a273465c1f8f5f3012418788ad2315b - ea8e472e5432665b009f2b89a8b96e337a273465c1f8f5f3012418788ad2315b

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787813173&P2=404&P3=2&P4=iZ%2feJJuWYN3YquDK9B0kFfpGWgxM2feSpJ3JN%2fsl24uGRWUKfJiWMIxHhH2iFjsweOE397pbcXjHItkEL2LByA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787813237&P2=404&P3=2&P4=dMdUODlptT%2fURKiqWltnoRp81efmTQ%2bXICm3HV88jvoVYbCHlvHKABOEZxwh8iMR0QiMZRi7zstMednoFRBPeA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.97
4.230.171.124
85.210.193.152
20.247.184.142
20.165.94.63
74.178.76.54
20.42.72.131
52.123.128.14
20.231.239.246
52.123.129.14
20.184.175.7
135.234.160.245
52.123.252.212
20.165.94.46
203.26.79.13
52.148.114.188
172.215.188.225
125.56.205.33
125.56.205.17
72.154.7.17
52.110.12.18
52.110.12.37

File paths

w:\=R

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report