MALICIOUS — 71a5d0d1531a4cebfdc0ee8d3add3ca59b1cdf2a75ef7f3f79ac3f7a277385a6

MALICIOUS — 71a5d0d1531a4cebfdc0ee8d3add3ca59b1cdf2a75ef7f3f79ac3f7a277385a6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 71a5d0d1531a4cebfdc0ee8d3add3ca59b1cdf2a75ef7f3f79ac3f7a277385a6
SHA-1: d513e5409041d4aadc5fcd96bf95cb0f0f3dfd63
MD5: 240a198ad1cfbf28b2c5251c8f3cffcd
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dsnnAyzn0Q1wxrJ0/J6tQdW5/g:Qoa1taC0xnnrzn11wx7xI
TLSH: T16C5A238655096B0CF2F6C5807D1816AEC842E4F7A378258B528FF06F77CBA2774111AB
Submitted as: 71a5d0d1531a4cebfdc0ee8d3add3ca59b1cdf2a75ef7f3f79ac3f7a277385a6
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2ECB.tmp - cabb5cd136d18fa0898f7471f880b6eb00d6c0b1514121e8b58ebb634dce0f1c
2ec7243e69c8c7db30a10be7f48fe66031af067cafc1f0a9841e376f07b0c3e4 - 2ec7243e69c8c7db30a10be7f48fe66031af067cafc1f0a9841e376f07b0c3e4

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787809565&P2=404&P3=2&P4=RjoKHyRPJxv5NE40rYTUhteVTX3hYi3uLF72O3AdskGrv3mro5iIdlYn5sDRzLR2nadcGuWoRzjYIWvs2g%2bCCA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787809613&P2=404&P3=2&P4=kCDnpLhIPeqbzKuYyTAiMxMXLuaEjo4L1xYpfZ6VlA2d5cm5h7wmaLg2i8mNS7ILo3%2fkCB8kShN85I6Yh%2by0zg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.184.175.4
52.123.252.194
4.230.171.124
40.84.97.4
4.144.132.223
20.165.94.63
74.178.240.51
20.42.65.90
20.112.250.133
52.123.129.14
52.123.128.14
162.159.142.9
203.26.79.13
172.178.240.163
52.123.252.243
20.165.94.46
52.123.252.238
52.110.12.11
52.110.12.22
52.148.114.188
172.215.188.225
20.184.175.12
20.42.65.89
125.56.205.34
125.56.205.51

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report