MALICIOUS — 52ef4cc3514bfadf47a6125322e497aac2740bdcc9d3ce8d2cdb5fab70324bdf

MALICIOUS — 52ef4cc3514bfadf47a6125322e497aac2740bdcc9d3ce8d2cdb5fab70324bdf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 52ef4cc3514bfadf47a6125322e497aac2740bdcc9d3ce8d2cdb5fab70324bdf
SHA-1: 175a7d9374d9f6fc04217d1a2cf4b6ddf28b60ee
MD5: 1b4332ba02347fb521bd1c34d89eb2f2
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070ds0Inf8ONuw9a0av+vA0axSqUU4uYbKUmd:Qoa1taC04Ix9zIfSqUtuY/md
TLSH: T10D5A238656492B0CE2F6C5447D29212ED441A0B3A77C2ACB42CFF01EB7C796B78215DB
Submitted as: 52ef4cc3514bfadf47a6125322e497aac2740bdcc9d3ce8d2cdb5fab70324bdf
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\A0FE.tmp - 4493f7ca1d8ce7294903cb3a3ed60a473721d2833ecfa8f396819eda1e010600
1c105be71c61fd77398a836db11154b37fe8009d51e616caa7149230a3f956f0 - 1c105be71c61fd77398a836db11154b37fe8009d51e616caa7149230a3f956f0

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787898060&P2=404&P3=2&P4=HT%2faO5TTmJoGVINsi4XTs90HFgiwJFtgzMOGVlMRaiBjhsac5Mzy6p4%2b0ssKBTVmEr%2fx1MCbmWarqG%2bKz0q67g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787898130&P2=404&P3=2&P4=XzBaVwK%2fPbIgXkWShwjZsgCk7tg9tI2GrlDyFyrwz69DkSI5bibzBZ0oiwzId2tjtcBSYBGxOTRxMMTDSxSoog%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.178.17.3
40.84.85.40
52.230.60.54
4.230.171.124
74.179.77.204
20.184.175.17
74.178.240.51
52.123.128.14
20.231.239.246
40.99.134.18
52.123.129.14
203.26.79.13
135.234.160.245
135.232.92.34
57.155.101.212
85.210.196.11
52.110.12.26
52.110.12.3
52.148.114.188
72.154.7.97
52.110.12.18
52.110.12.22

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report