MALICIOUS — 4b620d26d92a92deb8ee7cdb4a3af9e7b1547d65e4b9fbb6a1d5e4482ada8e5b

MALICIOUS — 4b620d26d92a92deb8ee7cdb4a3af9e7b1547d65e4b9fbb6a1d5e4482ada8e5b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4b620d26d92a92deb8ee7cdb4a3af9e7b1547d65e4b9fbb6a1d5e4482ada8e5b
SHA-1: e0cede298d79800fe419708fbf4b3d4a3055854a
MD5: a71fcc426f6f75b6cae9100f43dfb378
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF3mdAcigtW5bmnnxvoASdyGc:O+K88uPCH1mJN/vtSdyGc
TLSH: T1725A22818A165B4DE7F6D580380A66BE8082E5E6577C09CF038FF01E73DB56B74211AB
Submitted as: 4b620d26d92a92deb8ee7cdb4a3af9e7b1547d65e4b9fbb6a1d5e4482ada8e5b
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

102 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\458F.tmp - b0dd3e0b1e9dbe8d6ec218b5549e8bf0a4cf57b0de96b3444e8ca176816d88fb
afea3c556985123927c63b88bf9d7230d67dbf4824a20138ed595a4425661368 - afea3c556985123927c63b88bf9d7230d67dbf4824a20138ed595a4425661368

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787874683&P2=404&P3=2&P4=CR5U8ovppAyvAdeHFQ2b7IPhE%2bJnAJ4auYvgh4L9D6GXi%2bd2Su3DZ%2bG%2ftvEFcmKf1g6Vyxl8wYLzip0HnU8tow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787874754&P2=404&P3=2&P4=awgBtkfT8I7MgnZyGcYaeuU7UX8wVQg2bl4Z%2fyqoq5zs6aO8L%2bDtyzGYxrMpVCd7Wa0py0KSB3VuT5guPx49gg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
aefd.nelreports.net

Embedded IP addresses

20.42.73.25
172.215.188.232
4.230.171.124
20.247.185.124
20.165.94.63
74.178.76.54
52.168.112.67
20.231.239.246
52.168.117.171
52.123.128.14
52.123.129.14
135.234.160.245
20.42.179.192
52.123.252.197
74.178.76.44
52.123.252.241
203.26.79.13
52.110.12.4
52.110.12.46
52.148.114.188
20.184.175.21
20.184.175.1
52.123.252.238
20.165.94.46
72.153.5.131

File paths

n:\w
M:\j3

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report