MALICIOUS — 83c7cf98985de2749ca9fd4d4b5694ab8629a1899cc48cd05522be57b17ea49d

MALICIOUS — 83c7cf98985de2749ca9fd4d4b5694ab8629a1899cc48cd05522be57b17ea49d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 83c7cf98985de2749ca9fd4d4b5694ab8629a1899cc48cd05522be57b17ea49d
SHA-1: f261b34d4a3466339eb3f0ae26084bb56098db46
MD5: d10246126751b4e17c84899856290290
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFVMH4BFafQtEnmeoHFDutUOyIudX7m47QyGc:O+K88uPCHfrSCEmeoBCUOLudX7DQyGc
TLSH: T1315A23D6AA1E4B0DE3F6C8912819237EC541F5D68778488A424FF12E77DB96B343009B
Submitted as: 83c7cf98985de2749ca9fd4d4b5694ab8629a1899cc48cd05522be57b17ea49d
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2267.tmp - ab2d249170933eaa1d3e6dca4ff3d0ca1f95407a66d538d170869ee8fa5ac2e5
4679f9019f27d06731342bff4084032bf91213824e8fed1d388540561a99c523 - 4679f9019f27d06731342bff4084032bf91213824e8fed1d388540561a99c523

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787933770&P2=404&P3=2&P4=AIFTkgqnZSf6zMK%2fBRnuPvYQqQnmAm%2fOFdqB6bY%2f2t5uR3iQFZdplYVlzG1s%2f3UW4kyVKpeAZfSbV7377eS2Yw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787933846&P2=404&P3=2&P4=RxLV94YVE4kbyTa91firNNmVk2MLuNFjF0S7du3rYc8qpvaeQCbEJpYqLIp38O%2bGfXfpfE27IFZN2HkhuV%2b42g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.184.175.15
4.230.171.124
40.84.85.40
52.253.84.76
40.84.97.4
135.233.95.144
74.178.240.51
20.52.64.201
74.179.77.204
20.76.201.171
52.123.129.14
52.123.128.14
40.103.64.226
4.150.223.109
135.233.45.221
203.26.79.13
52.123.252.223
74.179.71.159
92.223.78.30
20.42.179.204
52.110.12.52
52.110.12.53
52.148.114.188
20.42.73.24
51.116.253.170

File paths

u:\1Hw

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report