MALICIOUS — 7e3bf74556d1ccf6cc4f31fc09f524484592224e280f8250a90e16c09d9130da

MALICIOUS — 7e3bf74556d1ccf6cc4f31fc09f524484592224e280f8250a90e16c09d9130da is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 7e3bf74556d1ccf6cc4f31fc09f524484592224e280f8250a90e16c09d9130da
SHA-1: 3527bddea9d2af37a8035fc0e6a7a8a4cc005265
MD5: b00928423a66f7a3055d2e752289a950
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFm15Tl+ucgdQXHuCpY7Xtgr9JILtsvyGc:O+K88uPCH8lxDuXHuCpu63IYyGc
TLSH: T1EA5A23C1AA298B0CE2F2D5803816666DC441F9D6AB7C088E528FF02D73DB97B7471167
Submitted as: 7e3bf74556d1ccf6cc4f31fc09f524484592224e280f8250a90e16c09d9130da
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\C0BB.tmp - 5ae68a7f632226d65cca546cd0a1d931192041563f4179c0c654de6ae7638920
114d7876a4c4522f8add798abdf266c9f2dcfad996e5d38343b6c91df6fc9fb1 - 114d7876a4c4522f8add798abdf266c9f2dcfad996e5d38343b6c91df6fc9fb1

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787875587&P2=404&P3=2&P4=DJKmuXmQ7g7JrHCl%2fqW3jMRNbDpecP5E0qyUMppefDDJIisXH9mnpZtio22MYPoo1mvflaLIPYc7n%2birSCc2IQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787875662&P2=404&P3=2&P4=lLFjWZLrzcrG4iNBerD2aDI2EbHV0Z2Gz90kdKI4tb71nTTDO7zAb7h5QEZR31KiKirAw73a%2bwBL8TUAcglk2g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.115
4.247.188.233
20.247.185.124
4.230.171.124
172.215.188.225
74.178.76.128
20.184.175.14
74.178.240.51
20.76.201.171
52.123.128.14
52.123.129.14
40.79.167.10
4.150.223.105
203.26.79.13
74.178.240.61
135.234.160.246
52.110.12.53
52.110.12.49
74.178.232.29
52.148.114.188
92.223.78.30
40.84.85.40
72.153.5.61
52.110.12.33
52.110.12.20

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report