MALICIOUS — virussign.com_07ecaccb3c1f01bdebfcafec33d1e020.vir

MALICIOUS — virussign.com_07ecaccb3c1f01bdebfcafec33d1e020.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Salat family. 2 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 8d2103c7b8adacf29ac7c5229b7509ab23229826bfc1ece447ca7d8bfe2c17d9
SHA-1: bad49c8bbe720f2f3fb75bfb8761100c08a7428c
MD5: 07ecaccb3c1f01bdebfcafec33d1e020
imphash: d2921ee0468211e522a7bd2607503c56
ssdeep: 24576:FtS+c/6MBjbdFcCXnsRwAAL78eRFJy9HUOPRaTBS34/2ySGRYnbBGZk/IG7DtOZ:G6Mr
TLSH: T18F689E31084F415A96BB3EBB7C4C6E1E7BD7E177300BA174688DF62A3E6508B7945088
Submitted as: virussign.com_07ecaccb3c1f01bdebfcafec33d1e020.vir
File type: pe · Size: 7624704 bytes
Verdict: malicious (94/100) · Family: Salat

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (2 of 55 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Kaspersky (KVRT): UDS:Trojan-PSW.Win64.Salat.prk

MITRE ATT&CK

Why this verdict

The malicious score of 94/100 is the fusion of 9 weighted signals:

Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted Salat config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13322 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

89f29b7521f4d3e04f5553e15918613c92098afc750fe19dcee8342f761c7801 - 89f29b7521f4d3e04f5553e15918613c92098afc750fe19dcee8342f761c7801
84a99a80c5b14f500a04ce5ae33083555a4812e0a0158c1967e2b7f073b80ed0 - 84a99a80c5b14f500a04ce5ae33083555a4812e0a0158c1967e2b7f073b80ed0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787936490&P2=404&P3=2&P4=YNpSUH4jGdcgJftvD1wtovjHQk1UcMDtb2UbBrbz%2fVHXYKp5qbn31%2fcJfIbXn7Nb%2biSY0AX0%2fNAbjFMih5R5Hw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787936547&P2=404&P3=2&P4=Kni7DE9B2y%2fn49%2bOx2VvTr5Pv7K1r0uYmYZBjuB%2bbN%2fK%2bBV697i2IOaCFOGl5bu3j7pi9hdymlraXdVXce5TQA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

dns.google

Embedded IP addresses

20.42.65.88
4.144.132.114
57.155.101.212
4.230.171.124
74.179.77.204
74.178.76.54
4.150.223.112
20.236.44.162
52.123.128.14
40.103.64.226
52.123.129.14
172.66.2.5
40.99.133.226
4.207.44.71
172.178.240.161
203.26.79.13
52.110.12.14
92.223.78.30
52.123.252.216
74.178.232.29
52.110.12.11
52.148.114.188
135.234.160.244
172.67.149.80
72.153.5.63

More Salat samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report