MALICIOUS — 3c7677dd1f066dc179aa7633ae2d0d8f7c82e0285a60283416a9690107e62675

MALICIOUS — 3c7677dd1f066dc179aa7633ae2d0d8f7c82e0285a60283416a9690107e62675 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3c7677dd1f066dc179aa7633ae2d0d8f7c82e0285a60283416a9690107e62675
SHA-1: 755b328bda49d6b89158d0f367412d4cecc4c5cf
MD5: c55a3e5f8ab31b4310aa5664ebe5be29
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFZ68sX4VDNXZxcaQiYuZrHE+KT90uYsZlyGc:O+K88uPCHfMXM/3NYuK+w6uLyGc
TLSH: T1B55A23CA5A198B0EF3F5C490280A26AEC182E8D6977C48C9424FF11E73DB9B76473157
Submitted as: 3c7677dd1f066dc179aa7633ae2d0d8f7c82e0285a60283416a9690107e62675
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\38CE.tmp - 2d04315896d458756833e4c35d9e77963d98a502d5238314651a9dea2fd69cd5
53c813ea6108ada3e1c4ab165caee441bf699361a75fb1d78c7145995399d273 - 53c813ea6108ada3e1c4ab165caee441bf699361a75fb1d78c7145995399d273

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787842001&P2=404&P3=2&P4=WZkcz%2fcW6uGC57Fbu3SiCBO38WZOG6qrJC27qJjeT5eXGFYW2%2fRUEvOmJ1dv8ghgXwAkPs9v3O1gnPn6l3qhEA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787842082&P2=404&P3=2&P4=AYzFHlK78LlfktbB3dywRb3nfcoJX5rL58A%2bT6BU0ZY7QTJLnIQymX%2fi1tNwlLuCNX9E3nyqRPB22kmP%2f6TUnA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

0.be
schemas.microsoft.com

Embedded IP addresses

4.247.188.224
20.42.65.93
4.230.171.124
172.215.188.225
4.144.132.223
135.232.92.137
74.179.77.164
20.42.73.24
20.231.239.246
40.99.133.242
52.123.129.14
4.150.223.115
135.233.45.223
162.159.142.9
52.110.12.54
52.110.12.45
203.26.79.13
52.148.114.188
135.233.95.80
52.123.252.222
72.154.7.98
52.110.12.51
52.110.12.1

File paths

Z:\{S

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report