MALICIOUS — 392642cae5b5bfb72bf5144b11e80db9b13711fc883075b3b1cf032c95da4c6b

MALICIOUS — 392642cae5b5bfb72bf5144b11e80db9b13711fc883075b3b1cf032c95da4c6b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 392642cae5b5bfb72bf5144b11e80db9b13711fc883075b3b1cf032c95da4c6b
SHA-1: 1c4489f81a208ede09d3c5bac7af5466c61c1646
MD5: cf9a23962993fe5ffb4e412dd2558e56
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFFU5PB4sWI53/vPGAD4SDn5HzH/NyGc:O+K88uPCH7A4svF/vPTkS1xyGc
TLSH: T1A45A23C5AA19574DE3F2C590281523AE8201F8DB93BC188E528FF01DB7DB4AB747215B
Submitted as: 392642cae5b5bfb72bf5144b11e80db9b13711fc883075b3b1cf032c95da4c6b
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\338E.tmp - 5fe8941f3f9a34fde6df862df2780840261f1d50ae0007dd5bc6cf761bb88b87
855b413e763ec99a4c4e04ccd4455a14407332382d8b06a67867f28bd85df733 - 855b413e763ec99a4c4e04ccd4455a14407332382d8b06a67867f28bd85df733

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787808357&P2=404&P3=2&P4=QWwAV3pQgwz6S0D9aPMmrfbNsy4yPOO3O%2fafn5T7euy1nnedilGTApKOa9GdXv68uILRTNgGUKWPWXeAXpPWFg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787808440&P2=404&P3=2&P4=a8CctyTPqEFtoHQEOtWqNTP4clgd6vBBnn7E3ZE0rxTSwqhTfYO5xoiEij9LVl3AaliDsgYsIfTfPryffaXHiQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.65.91
4.144.132.223
4.230.171.124
20.42.179.192
20.165.94.63
135.233.95.135
4.150.223.115
52.123.128.14
20.76.201.171
52.123.129.14
135.234.160.245
203.26.79.13
20.165.94.46
52.110.12.33
52.110.12.8
52.148.114.188
162.159.142.9
125.56.205.32
125.56.205.17
92.223.78.30
72.153.5.131
52.110.12.45
52.110.12.53

File paths

w:\m
h:\y4

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report