MALICIOUS — 4b3066171cc32c41b06e8e0741b5835ab7b93e1c1df5f9bcf6d72429f9e4729b

MALICIOUS — 4b3066171cc32c41b06e8e0741b5835ab7b93e1c1df5f9bcf6d72429f9e4729b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4b3066171cc32c41b06e8e0741b5835ab7b93e1c1df5f9bcf6d72429f9e4729b
SHA-1: cfc9ec40bf401ad8d918015d8f4c212f356b44ca
MD5: fb79afb368b3b11c91ce059fded890d7
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFpZVOw9qDnTHdTo28pAFw5skL7N8P0UyGc:O+K88uPCH95qXqgFwmklvUyGc
TLSH: T18F5A23895B285B4DE3F2C45138193A7D8181E8D6A67C09CA838FF12D73D792B743219B
Submitted as: 4b3066171cc32c41b06e8e0741b5835ab7b93e1c1df5f9bcf6d72429f9e4729b
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

102 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2AC4.tmp - 6a61d560563654d07729b7c3b56c56cb1a558404f5f5ba21a549cec68d5993eb
d769bd58feff052b455bc24b930b7e937a1fc3417d326e32c14df9f985952c6d - d769bd58feff052b455bc24b930b7e937a1fc3417d326e32c14df9f985952c6d

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787792473&P2=404&P3=2&P4=XwW%2b4UoAiKpEhyXM3LwUKyuUa3eW2KtSUJQiIqm1%2b9XNtfZbCipErT7%2fJz3V5rQemA8IamLO2G9BSBxUKmxpoQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787792509&P2=404&P3=2&P4=PHy8Ud%2bGQcZjuDmSMbPvbPbG9gQBjm0F4oHI4k9JZu00ow2jEcUIhwDbWMXo5gYhnHxsotQMuDHSiCpc%2b9Yvvw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.184.175.1
57.154.63.210
4.230.171.124
52.230.59.222
48.211.4.16
74.178.76.128
20.42.73.26
74.178.240.51
20.231.239.246
40.104.4.2
52.123.129.14
52.123.128.14
20.42.72.131
135.233.45.222
52.123.252.241
20.184.175.4
203.26.79.13
135.233.95.80
52.110.12.54
52.110.12.37
57.155.101.212
52.148.114.188
72.153.5.129
135.232.92.34
52.110.12.18

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report