MALICIOUS — 3f9b6919c60d8225179aec6a25a96994f40eeb27ad3b6adab9f39bd43d758a1c

MALICIOUS — 3f9b6919c60d8225179aec6a25a96994f40eeb27ad3b6adab9f39bd43d758a1c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3f9b6919c60d8225179aec6a25a96994f40eeb27ad3b6adab9f39bd43d758a1c
SHA-1: fa5d8f22bd10f6bfe506823a6dec68607529f469
MD5: 31dacf57f8126277dbcca4b5cdb4432e
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF9qsTNX268vClijLz2UW247jyGc:O+K88uPCHTq4bQ2d2KjyGc
TLSH: T1965A23C459265B4DE6F2C540280E26BEC542F5C692BD188A538FF02E73EB9377832197
Submitted as: 3f9b6919c60d8225179aec6a25a96994f40eeb27ad3b6adab9f39bd43d758a1c
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\22D5.tmp - 3a3cc7907221d4ce7b11d93cf98d97f79b6b8e685dca17b15ca43fb4c5ed451e
55b9d09cb357c8cd4d08f2a59b5d46b0a3a28adaf8cdac2426da726823fff9a9 - 55b9d09cb357c8cd4d08f2a59b5d46b0a3a28adaf8cdac2426da726823fff9a9

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787835694&P2=404&P3=2&P4=AuvYrQF8HIkKNYDLt9Dw1PruYJhYK9Wd%2fy5WYQRE%2f7yDB6%2b%2fFPm8feuBhnTQJa6bmDWFzdQmPT%2bFybZ9LuJuHg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787835762&P2=404&P3=2&P4=KrfclqK9NRm3RIAhz7AltZwc%2fXQ6q7e8IOQjnj31VlNR1mZOS%2bK9BvtSJWENv5LdmXnjvryUkPL2v3nD2JQL1w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

5o.au
schemas.microsoft.com

Embedded IP addresses

13.69.116.105
52.123.252.215
85.210.196.11
4.230.171.124
20.247.184.197
20.165.94.63
74.179.77.164
52.168.117.170
92.223.78.30
20.184.175.12
20.236.44.162
40.104.4.2
52.123.128.14
40.99.133.242
135.233.45.221
57.155.101.212
52.110.12.49
52.110.12.52
203.26.79.13
52.148.114.188
52.123.252.247
135.233.95.80
74.179.71.159
72.153.5.131
52.110.12.50

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report