MALICIOUS — 7bf14d3177543f3bcf806924988c3a88dcf6d411d7336bd4f20c50dadb275b71

MALICIOUS — 7bf14d3177543f3bcf806924988c3a88dcf6d411d7336bd4f20c50dadb275b71 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 7bf14d3177543f3bcf806924988c3a88dcf6d411d7336bd4f20c50dadb275b71
SHA-1: ee23d0d3c07cb276e6848d825291704eb9a72808
MD5: 2431b178b00d6253bdcafa8dda99892e
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFE8/IujJOvSh8QGiQyNET9um4qg1yGc:O+K88uPCH6sIujlhNs9F4HyGc
TLSH: T1B65A22C56B2A9709E7F6D490291576BDC502E0D5C67848CF928FF02DB7DB8AB3022097
Submitted as: 7bf14d3177543f3bcf806924988c3a88dcf6d411d7336bd4f20c50dadb275b71
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\9F29.tmp - 9e4343c9df1b5966ce178f2125a2ffde2210864c1ea9a7b44ee522ff3d1536ea
23a5680a839ff82ca238b7f1a4ebe3710a164cab3f08abe8778e6d782f6b0b29 - 23a5680a839ff82ca238b7f1a4ebe3710a164cab3f08abe8778e6d782f6b0b29

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787837771&P2=404&P3=2&P4=btI9hLTcgMNQrOM7nRhGUjzNhFeggau9iK%2fWyQ8cnysHeT%2fcbYDPM1%2fI7niao4nB%2bhx3MGSK3rcmwFjqFk5mzg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787837817&P2=404&P3=2&P4=QESLcQS6YYCrsy%2bs6WggU%2bJ2ar0mZVUvPlGawHyWtleExWEV%2fVBiJno%2bjAXgrzNw08OHrOw0jEPSdv30w2v2mQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.123.252.192
51.116.253.170
4.230.171.124
20.247.184.197
4.247.188.233
74.178.240.61
20.42.72.131
74.178.240.51
4.150.223.114
52.123.129.14
20.112.250.133
52.123.128.14
135.234.160.245
203.26.79.13
162.159.142.9
74.178.76.44
52.110.12.53
52.110.12.18
52.148.114.188
72.153.5.129
52.110.12.16
52.110.12.48

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report