MALICIOUS — 4153c7d80fa9d589b1ab17f06f06a73784b484b482f09dd4c677fa5acdfd5291

MALICIOUS — 4153c7d80fa9d589b1ab17f06f06a73784b484b482f09dd4c677fa5acdfd5291 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Salgorea family. 3 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 4153c7d80fa9d589b1ab17f06f06a73784b484b482f09dd4c677fa5acdfd5291
SHA-1: 251c01492daf05bc6b189d35cfbe31c101af7e30
MD5: cf9995dc88cc01878294c342324e15e7
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dfq+CVVkGhYT1TBtLWltZj7MNL//:Qoa1taC0aXCzlhMtMg/
TLSH: T1F95A2346464D670CE3F5C4843D28116EC441E8E7A7782ACB628BF05EB7CB9AB742059B
Submitted as: 4153c7d80fa9d589b1ab17f06f06a73784b484b482f09dd4c677fa5acdfd5291
File type: pe · Size: 1958408 bytes
Verdict: malicious (96/100) · Family: Salgorea

Detections (3 of 25 engines)

Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 5 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 50 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/26796/files/4d71358f20ba956415409476774ec7306a1e312a5f7d2d239c5adae583015088 - 4d71358f20ba956415409476774ec7306a1e312a5f7d2d239c5adae583015088
f1f6698096afca7d792c0aac7e3e4ce2fe8cf614f194a667bb0dc98d23425cea - f1f6698096afca7d792c0aac7e3e4ce2fe8cf614f194a667bb0dc98d23425cea

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786970152&P2=404&P3=2&P4=Z7JA4%2fh4GjpuBoBHguLzwDrpkWExpRut%2bg%2fQWxMVsjYrlKqAtL6xCdxg4KQpD2o2PipF7%2bMQeQvBxx%2fNwkBsLg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

9.in
schemas.microsoft.com

Embedded IP addresses

20.42.73.28
52.110.12.50
20.247.184.142
172.215.188.225
4.230.171.124
135.233.95.144
52.168.117.170
20.112.250.133
52.110.12.5
172.215.188.232
20.76.201.171
20.42.65.88
172.178.240.162
52.110.12.42
20.165.94.54
40.79.167.10
92.223.78.30
20.165.94.63
172.66.2.5
52.123.252.212
162.159.36.2
203.26.79.13
52.168.117.169
72.153.5.96
20.165.94.46

File paths

u:\$~

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report