MALICIOUS — 96732c9e5aa5330ce2801485547d8f0e68f8a4a243a0bc9f27a8f995fb23ea08

MALICIOUS — 96732c9e5aa5330ce2801485547d8f0e68f8a4a243a0bc9f27a8f995fb23ea08 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 96732c9e5aa5330ce2801485547d8f0e68f8a4a243a0bc9f27a8f995fb23ea08
SHA-1: 17a8dee0f786c196a7d829ce4080b456b1b0ff0b
MD5: be7ba7e42742c6648412ae10bf757dc5
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFdF3RB0QA4ZGwJ/kuWzwFMW07A+uyGc:O+K88uPCHPnBTdo7HwFp07ANyGc
TLSH: T1D45A23C69A299B08D3F2C5802819366D8181B4E2977C59CB538FF11D73EB97B60321DB
Submitted as: 96732c9e5aa5330ce2801485547d8f0e68f8a4a243a0bc9f27a8f995fb23ea08
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\E143.tmp - cfc59b30f7544001a80f4bcdfdef6f0e833359d8d295b6d9c5c3fbed270edf59
aef9bd5c7910a4671852574d0bb8e785d9e478454e1f7b70cd7db5feb1de0e76 - aef9bd5c7910a4671852574d0bb8e785d9e478454e1f7b70cd7db5feb1de0e76

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787826970&P2=404&P3=2&P4=fjmhzxNvycPzvLNJ6%2fyoKHoayLbr2CRlV5gMu1euNQtcQ3ROY8tPdjWD65U3V7OGitGGaZOlvgW0FS%2bv9lUS0w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787827046&P2=404&P3=2&P4=CpB7yTEaLZo8lrSwvXAttlT6ETMnSTnYh4jN%2bYI4bSo962SWApknVCkPKZoz6UKRb5GGptEhZvCsg7EFnhR%2bpg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.73.26
52.230.60.54
172.215.188.232
4.230.171.124
57.154.63.210
74.178.240.61
4.150.223.106
74.178.240.51
52.123.128.14
20.231.239.246
52.123.129.14
162.159.142.9
135.233.45.223
203.26.79.13
52.123.252.232
74.178.76.44
52.123.252.230
20.184.175.5
52.148.114.188
72.145.35.100
142.250.183.35
52.110.12.45
52.110.12.48

File paths

r:\p

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report