MALICIOUS — 8a1cfd0bd3149d872c7bd51d36a3fc09dd696d7375159bd4c58b02c9ee86a8ed

MALICIOUS — 8a1cfd0bd3149d872c7bd51d36a3fc09dd696d7375159bd4c58b02c9ee86a8ed is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8a1cfd0bd3149d872c7bd51d36a3fc09dd696d7375159bd4c58b02c9ee86a8ed
SHA-1: 22e255c9cf51dd9e7de33da4d0bd2a63d9f20ffd
MD5: 9b7b85e434336c2fcf3bc9b3e7a3ba40
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFNGNzMdt5twMI0hzSmEyr0WE9plPPeuJyGc:O+K88uPCHTACAUSzUE9phPdyGc
TLSH: T11E5A2386561A970DE7F2C940281627BE8042F5D6937C498B538FF12E73EB86B743109B
Submitted as: 8a1cfd0bd3149d872c7bd51d36a3fc09dd696d7375159bd4c58b02c9ee86a8ed
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\25A3.tmp - d2fc51f3b96b5468f6dfd98f0f0a274b12d8f678fbe7bcc17572c6825bdffadf
16642733b3d3dae3489dcbeb9090fe2d8dd030f605282c952369a5b6ac02e509 - 16642733b3d3dae3489dcbeb9090fe2d8dd030f605282c952369a5b6ac02e509

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787935604&P2=404&P3=2&P4=btdc4IKlkepWW1TYYaL69qGctyy09c9fx3wl%2f4p6HRejjUgMzFYkjQabhmxUYzZojivTMk4vcoy0Vnrg7Vz7Kw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787935684&P2=404&P3=2&P4=meDKWentJXAIMEQ4Hbm2ZIRq3NXo8v%2bx5L9zWYFwGF%2fnMz69PIT3JI6G9ji2Y%2bw8Z9perTD5XGcJTY%2bziRdNuA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.123.252.198
20.42.72.131
4.230.171.124
4.144.132.114
85.210.196.11
74.178.76.128
52.168.117.171
74.178.240.51
135.233.95.144
20.76.201.171
52.123.129.14
52.123.128.14
40.103.64.242
40.99.134.18
4.207.44.66
135.234.160.245
52.123.252.233
203.26.79.13
52.148.114.188
52.123.252.195
20.165.94.46
52.123.252.192
72.154.7.108
52.110.12.47
52.110.12.19

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report