MALICIOUS — 4d90904f1fb4add37732614cdbf6be7612ba5e0acb9afb87cfe2d4d1868cbc6d

MALICIOUS — 4d90904f1fb4add37732614cdbf6be7612ba5e0acb9afb87cfe2d4d1868cbc6d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 4d90904f1fb4add37732614cdbf6be7612ba5e0acb9afb87cfe2d4d1868cbc6d
SHA-1: 68355c842818dcc3864290955b13e69351a60bdf
MD5: ab2a53107269ec6ba5161b5bc936e07e
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dVFwClwDjrmlohH5VEhLek0Nr4kRep:Qoa1taC0lreK52VM4kRk
TLSH: T1795A2389A619B70CE2F6C4403C58166D8442E8F7A77C168F528FF05E73D292B78611EB
Submitted as: 4d90904f1fb4add37732614cdbf6be7612ba5e0acb9afb87cfe2d4d1868cbc6d
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Zusy): C8C9.tmp - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\C8C9.tmp - 2d211c97570bf8eb86fba3f3a1c08ff8d9b4eb647665675c5c76a4134614b5d8
41932139ec029e6a09ad6af98ac36c7136cddba7f1a5da685721dd4741e8447f - 41932139ec029e6a09ad6af98ac36c7136cddba7f1a5da685721dd4741e8447f

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787651441&P2=404&P3=2&P4=Zm5IeQUQYg3th1S5WiJppUrSQaZeJhAic6XTqaEWfWkgQAM529hL1j3v48JmJx4vVJ8JTUsd%2b15L8mKHaojjgA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787651522&P2=404&P3=2&P4=eEuaM1SvGVDQoR9O7C77%2bI8xwPEWVZpjyFvbQDozYbvMD5YHrj9vtrv6w9N9L92rrpUb9ynEe44oy6%2bM5ttfYg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.65.93
52.123.252.203
52.253.84.76
40.84.85.40
4.230.171.124
135.233.95.144
74.178.240.51
4.150.223.108
52.123.252.193
20.236.44.162
52.123.129.14
52.123.128.14
162.159.142.9
20.165.94.46
52.110.12.5
203.26.79.13
52.110.12.18
172.178.240.163
92.223.78.30
52.123.252.202
135.232.92.34
52.148.114.188
72.153.5.135
4.150.223.109
20.50.201.203

File paths

J:\%

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report