MALICIOUS — 6f6641c680e677677cff4979a3becebb8eb3ca4c16dc827edb85f33f834b27a2

MALICIOUS — 6f6641c680e677677cff4979a3becebb8eb3ca4c16dc827edb85f33f834b27a2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6f6641c680e677677cff4979a3becebb8eb3ca4c16dc827edb85f33f834b27a2
SHA-1: a13a897cc34552c762411ae534df4d634c3d5326
MD5: 38cf397c40c88a40800b861f610b8d1d
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF2nSF5hP4udJFoxsPENyGc:O+K88uPCHEnSro9NyGc
TLSH: T1EE5A23828D194B09E7F5C980280A3B7E8541B8D6927C49CE928FF13D33DB86B64350DB
Submitted as: 6f6641c680e677677cff4979a3becebb8eb3ca4c16dc827edb85f33f834b27a2
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\467A.tmp - b1276505a3442da864e6b38927cf97a4cbc61ad0095efb7cb6b066269c250b47
30a34be20ad6111f95fce85f10bb7273a4cf9c9284e2a461f80b0f61be38242e - 30a34be20ad6111f95fce85f10bb7273a4cf9c9284e2a461f80b0f61be38242e

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787927193&P2=404&P3=2&P4=JuRelvpnx05Xq86YFLwG4XjYelOQS%2blUBZBbXM4Qhtg5Xn8ainUFSQ08Qrlv5pRRmRjb8i5mI3fcYN0ysRVJhQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787927206&P2=404&P3=2&P4=h8juIYnB%2bADHVAAHLCozMpqwu4ktwxqElyZKFEI8TSWbfa5kKkcIH60ChFdrnjZkVWIKHGWG6a02fmpMiwWzKA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.179.204
4.150.223.111
52.123.252.231
4.230.171.124
172.215.188.225
52.230.59.222
74.178.76.128
20.184.175.1
74.178.240.51
135.232.92.137
57.155.101.212
20.231.239.246
52.123.129.14
40.103.64.242
20.184.175.11
172.178.240.162
162.159.142.9
52.123.252.203
52.123.252.202
135.233.95.80
52.123.252.247
203.26.79.13
52.148.114.188
52.110.12.20
52.110.12.52

File paths

F:\7X

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report