MALICIOUS — 8903aec30042e9538dbabe16431c98ea409021c16270ea43b9dc9c5d4f18553f

MALICIOUS — 8903aec30042e9538dbabe16431c98ea409021c16270ea43b9dc9c5d4f18553f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 5 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8903aec30042e9538dbabe16431c98ea409021c16270ea43b9dc9c5d4f18553f
SHA-1: aa83b07e3b03391d27b6455706aef5fc3f3b8760
MD5: 2d0b5e987745f59210127802005a8dcc
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 98304:emhd1UryeaSt5rCflsSVLUjH5oxFbxCVLUjH5oxFbx:el6SK+SVUjZEdCVUjZEd
TLSH: T1EF6223EA53364B8DE0B1C4C81F26229C881294D956FF39C2854FF12FB3EE5972861197
Submitted as: 8903aec30042e9538dbabe16431c98ea409021c16270ea43b9dc9c5d4f18553f
File type: pe · Size: 4453888 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.l2
ClamAV (daily): Win.Trojan.Finfish-9787043-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.Agent.GIKJ
Kaspersky (KVRT): Trojan.Win32.Agent.xaktra

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.Finfish-9787043-0 (rule Win.Trojan.Finfish-9787043-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: high-entropy-sections:.l2 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2555.tmp - 349bbe5ef8987680afd02ba4d79a04c2180adab76bf01affddf9abbec2380efb
813f96097c97f8f78de45984f59b678a4953fc1d18fa4ba4c673082410781161 - 813f96097c97f8f78de45984f59b678a4953fc1d18fa4ba4c673082410781161

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787836006&P2=404&P3=2&P4=AygvhW0jMtUJBFJYo6uibRE%2bqJv9UwRmo2T8rOjhlyc0vgHXHLgCguHrqAbZLMtG6LxrUVZ%2b%2fB%2fbo4cQ%2f08Qeg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787836069&P2=404&P3=2&P4=AzJsMCXshxYj7emTzbTrY%2bC1EUU7bYVicV807Y0el4FyBfwAhDPOaw3SPadQGiSnMW%2fmERKW2gmeEdm%2bVYj6mQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

r.cc
schemas.microsoft.com

Embedded IP addresses

4.150.223.109
4.144.132.223
4.230.171.124
40.84.85.40
74.179.77.204
20.52.64.200
20.112.250.133
52.123.128.14
52.123.129.14
20.165.94.54
20.184.175.20
135.233.45.222
52.110.12.54
52.110.12.16
203.26.79.13
52.148.114.188
20.165.94.46
172.215.188.225
20.184.175.5
72.153.5.61
52.110.12.48
52.110.12.20

File paths

I:\hizh
b:\l
m:\w\C

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report