MALICIOUS — 445f2abdf10e708beb4b5fe32bcd6d5941e7de03bec8882d85fbe89da1ba6a11

MALICIOUS — 445f2abdf10e708beb4b5fe32bcd6d5941e7de03bec8882d85fbe89da1ba6a11 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 445f2abdf10e708beb4b5fe32bcd6d5941e7de03bec8882d85fbe89da1ba6a11
SHA-1: 8982fd586641d170366bc434e8b094642411c856
MD5: f4e28b80acb9f1a56d4fa0f1f80fa879
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dn1JRqawmNteVOB0CRlvlO3Q:Qoa1taC0u/Rqa1NteVOplvlO3Q
TLSH: T1525A23495609670DE6F5C4807C2912AEC841E4FBA33C198F528FF15EB3CB95BA8121DB
Submitted as: 445f2abdf10e708beb4b5fe32bcd6d5941e7de03bec8882d85fbe89da1ba6a11
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\3592.tmp - 37f20d4b89ad361f4e46513ce55d3ea4260b99d8a8e675ccf9e4b7b529dea96e
1d74997d8bf4f6e66204d1deafc0203cfed672260fe8e6176a5e2cfe842749c8 - 1d74997d8bf4f6e66204d1deafc0203cfed672260fe8e6176a5e2cfe842749c8

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787794301&P2=404&P3=2&P4=Psm%2b8w%2fi3awpSFdOLtzOBHqkFtJDd78As18UaZJduUYIUlbOx%2bd6V81VZzGkHZZMHgJzYScfQtYHuBkREFjcdQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787794369&P2=404&P3=2&P4=liq2Hqe5QHGzdKr1UcLh3KreWEYjI8HcDFPhe%2b2khPj54hJ771%2bYwH4Y79gKhLlLBgaj773yJKP4rujauG%2bYqQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

e.in
o.cn
2.ir
schemas.microsoft.com

Embedded IP addresses

52.123.252.235
52.168.117.169
4.230.171.124
4.144.132.223
4.247.188.233
135.232.92.137
74.179.77.164
20.50.201.206
52.123.129.14
20.236.44.162
52.123.128.14
135.234.160.247
20.42.179.204
92.223.78.30
52.110.12.48
52.110.12.56
203.26.79.13
52.148.114.188
135.232.92.34
72.145.35.97
52.110.12.24
20.165.94.46
52.110.12.20

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report