MALICIOUS — 443445aa2dcdad4829c8438e3a1cdba4cb3e51e856d937cb86a17efcb6d3509f

MALICIOUS — 443445aa2dcdad4829c8438e3a1cdba4cb3e51e856d937cb86a17efcb6d3509f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salgorea family. 4 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 443445aa2dcdad4829c8438e3a1cdba4cb3e51e856d937cb86a17efcb6d3509f
SHA-1: 2543622d2b1b995b0718558e4b691f9502e2fda0
MD5: 6fb47596642039b9f308648ddb8a181a
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFZcxhj0370QilyPyBrkIyFv0bNkE3mixniA0KgNkyGc:O+K88uPCH/e6370QilyPyBrvIcNrxnaD
TLSH: T10B5A23C58A299B09E7F2C8903C2625ADC041F4D2A67C15CE928FF11E73EB567783119B
Submitted as: 443445aa2dcdad4829c8438e3a1cdba4cb3e51e856d937cb86a17efcb6d3509f
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Salgorea

Detections (4 of 52 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Zusy): 27fcf5679e5f3adbea93acdf5226b9936311ef0fcd73ce44bd281ba00113ac14 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8088) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 55 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

101 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/26835/files/27fcf5679e5f3adbea93acdf5226b9936311ef0fcd73ce44bd281ba00113ac14 - 27fcf5679e5f3adbea93acdf5226b9936311ef0fcd73ce44bd281ba00113ac14
f4b999020753738011e9ccd5ccf18ba73020ebcea24db1c5dfd19d9f5e1611e9 - f4b999020753738011e9ccd5ccf18ba73020ebcea24db1c5dfd19d9f5e1611e9

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

40.79.150.122
52.123.252.219
85.210.196.11
20.247.184.142
20.42.179.192
20.42.65.88
20.76.201.171
172.178.240.162
57.155.104.224
4.230.171.124
135.232.92.97
20.165.94.63
52.168.117.175
52.110.12.15
52.123.252.240
20.231.239.246
52.168.112.67
52.110.12.55
52.123.252.234
52.110.12.46
52.123.252.194
52.123.128.14
92.223.78.30
162.159.142.9
52.123.252.235

File paths

n:\a

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report