MALICIOUS — 860b7d3f17b97315b19d4c04ba0fb864a9ef3fb9e9dacfc792c93acde1526c29

MALICIOUS — 860b7d3f17b97315b19d4c04ba0fb864a9ef3fb9e9dacfc792c93acde1526c29 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 860b7d3f17b97315b19d4c04ba0fb864a9ef3fb9e9dacfc792c93acde1526c29
SHA-1: dcc1966a011fb7bb995fbae53fbc0e6fa0ae886f
MD5: c07c33c317e70446dede40a2531f6831
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dzf7wkbXHQD7GixO2fon5c:Qoa1taC0oXHQHGGn/
TLSH: T12E5A235A5A056B0DE3F2C4447C2817ADC481A4E2677C298F93CFF05EBBC6927782119B
Submitted as: 860b7d3f17b97315b19d4c04ba0fb864a9ef3fb9e9dacfc792c93acde1526c29
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\AB00.tmp - a2bce5639b51d1ca0db0d896b05b1f162dd463bd70cadde1ca06dbf4b8590404
7f84135dc979a32819c48e7e8a70cf82f086778e9116371e3c2f52e7bc6b6a4a - 7f84135dc979a32819c48e7e8a70cf82f086778e9116371e3c2f52e7bc6b6a4a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787811990&P2=404&P3=2&P4=jFJbJiCpeIeWFwqI7yWprNoEYe8YFQWufE1jp2HP2AKYGBQBkvzypu%2f6POSt0x0AJgDsicJaHltgM6z0gWoMVQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787812032&P2=404&P3=2&P4=k0GJ2%2fUmUneZrGkdE5FGFmIzpW0a1i357J51TdqXtp2%2f5PzydT9QywmiUFqJICsL2wdxziESL6LPfUL4an6GsA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

x.me
uo.jp
schemas.microsoft.com

Embedded IP addresses

4.150.223.100
52.123.252.193
4.144.132.223
4.247.188.233
4.230.171.124
52.230.59.222
172.215.188.232
135.232.92.137
135.232.92.97
4.207.44.65
20.236.44.162
52.123.129.14
52.123.128.14
52.168.112.67
135.234.160.245
162.159.142.9
20.165.94.46
203.26.79.13
52.110.12.50
52.110.12.51
20.42.73.28
52.148.114.188
125.56.205.114
125.56.205.32
52.123.252.231

File paths

K:\dq1
O:\I7I

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report