MALICIOUS — 5713e94043c4b53a62fbf95dfb9e81a1450863a2d81c6a6d5afa53087efd85b8

MALICIOUS — 5713e94043c4b53a62fbf95dfb9e81a1450863a2d81c6a6d5afa53087efd85b8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5713e94043c4b53a62fbf95dfb9e81a1450863a2d81c6a6d5afa53087efd85b8
SHA-1: 83ffbff1bb86a2296db17bfb84c849657be8f4e4
MD5: b84912511c77ef963bc26796fa44d41d
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dzx8pqCWYnCrP4/qaHEQ3X3EmSZp8:Qoa1taC0WpCxCsjkQ3Hxy8
TLSH: T12A5A2346561A670CE2F6C0903D6C166DC842F4A6A77C3A8E42CFF19EB3CB527381159B
Submitted as: 5713e94043c4b53a62fbf95dfb9e81a1450863a2d81c6a6d5afa53087efd85b8
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

136 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\F76B.tmp - 2dce0f01cf139af455c2200d6487b4c3ab2e6b614e3dfcfb9e4d049a925d39bf
e79829ee665b30f18008feff2ab7286b835c2b697b0e7a9500eba9a1776726d9 - e79829ee665b30f18008feff2ab7286b835c2b697b0e7a9500eba9a1776726d9

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787874103&P2=404&P3=2&P4=N6YczN48ZxBKi9BCgzIGy8oFQBM7A69j1Jd2xXSWQWa5%2f7J%2f3DuD3oVFNzc2cBgVFr4uPtApx2b%2fI4BiXVD9zQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787874165&P2=404&P3=2&P4=XFFOMkeqHfM2K5myaAvzOPEqoBb0X7uIP42oo71fAZGdo4J3gQ57bJ2kEa8CFMEz5Xv42C%2fQOJBvOYBUJQwfmA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

40.79.141.152
52.123.252.246
40.84.85.40
4.230.171.124
4.144.132.223
74.178.76.128
74.178.240.51
51.104.15.253
40.104.4.2
20.76.201.171
52.123.128.14
52.123.129.14
172.66.2.5
20.184.175.23
52.123.252.197
135.234.160.244
162.159.142.9
52.123.252.220
203.26.79.13
74.178.76.44
52.110.12.26
52.123.252.243
52.123.252.224
52.148.114.188
92.223.78.30

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report