MALICIOUS — 8933d55db9bdad0d4a6f44d05f3f677eed4bd8f1459310840d82962754aadaae

MALICIOUS — 8933d55db9bdad0d4a6f44d05f3f677eed4bd8f1459310840d82962754aadaae is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salgorea family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8933d55db9bdad0d4a6f44d05f3f677eed4bd8f1459310840d82962754aadaae
SHA-1: a8cff3b411584e0b5bd3bcd1cf6e489bb9260e3b
MD5: 6f84683425485b713fcfaf3f042016a4
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF0/Z7gBZKGa77tHvag4RY4GnJ/a3We0OqGlyGc:O+K88uPCHm/Z8TDaXtHigYyVoRByGc
TLSH: T1965A2386AA2A5B0DE7F6C580381A276E8542F8D1877C058B834FF01EB3DB96B7471057
Submitted as: 8933d55db9bdad0d4a6f44d05f3f677eed4bd8f1459310840d82962754aadaae
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Salgorea

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12913 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\F378.tmp - 25d1c05a92b1b5fe05294ce67c2fc2eee406e8ae4dedc205586d0c2e6dcb52dc
c:\users\analyst\appdata\local\temp\tsk_3ae09a6982b540ee.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
06c3556018e1aea04f35d635d462e1585056e1a397dee94ef1a3a6c4df16aada - 06c3556018e1aea04f35d635d462e1585056e1a397dee94ef1a3a6c4df16aada

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

e.ca
schemas.microsoft.com

Embedded IP addresses

20.184.175.0
52.253.84.76
4.230.171.124
48.211.4.16
135.232.92.97
4.150.223.97
135.232.92.137
52.168.117.174
52.110.12.10
52.110.12.20
92.223.78.30
172.178.240.162
85.210.193.152
20.50.201.205
4.247.188.224
104.208.16.94
72.145.35.98
52.148.114.188
52.110.12.15
52.110.12.26

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report