MALICIOUS — 5c7f1fa81b03f082329f69f90c4200cad53a29aaee2337858003dcd932fec5a9

MALICIOUS — 5c7f1fa81b03f082329f69f90c4200cad53a29aaee2337858003dcd932fec5a9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salgorea family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5c7f1fa81b03f082329f69f90c4200cad53a29aaee2337858003dcd932fec5a9
SHA-1: ab444ebb1016709f46cc4a4090b04e03a2628fe2
MD5: 9422afabfc4a264edc135c7ab8217fdd
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFxaSJx5XeerhLmfbQ0yGc:O+K88uPCHuSlXVL6jyGc
TLSH: T1C95A23C69A299B4DD7F2C5D13815237D8042F5E69B78188A428FF02D73EB4AB343119B
Submitted as: 5c7f1fa81b03f082329f69f90c4200cad53a29aaee2337858003dcd932fec5a9
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Salgorea

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

9408 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\5956.tmp - f06e161f5950cc73d93edbed9a11a4e4d13a4032ac0c39352e6790bd34a09549
c:\users\analyst\appdata\local\temp\tsk_3688f337106c4472.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
cf74bdae65cd65292fe8888389823aff334eaaa8d95c011b3007f1897b54dea8 - cf74bdae65cd65292fe8888389823aff334eaaa8d95c011b3007f1897b54dea8

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

j.fi
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.25
52.123.252.240
4.230.171.124
20.42.179.192
20.247.184.142
20.165.94.54
4.150.223.96
74.178.240.61
104.18.33.89
4.150.223.103
51.132.193.105
74.179.77.204
52.110.12.32
52.110.12.52
125.56.205.26
125.56.205.113
72.145.35.107
52.148.114.188
52.110.12.25
52.110.12.16

File paths

N:\S

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report