MALICIOUS — 9a0cff83cfcefe60ce799c3b8c0c11b5459f676a8c30ee968d4cc427259ab7b8

MALICIOUS — 9a0cff83cfcefe60ce799c3b8c0c11b5459f676a8c30ee968d4cc427259ab7b8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 9a0cff83cfcefe60ce799c3b8c0c11b5459f676a8c30ee968d4cc427259ab7b8
SHA-1: 224e1d539b1ca3a655fd334aa6de9d9542ab6865
MD5: 1f0f09850023e96134e35fdafde3f144
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dzpAFY4vzWGNEzdxaY9Mck1FocUEA:Qoa1taC0Q4vzWGNEpxscCocUEA
TLSH: T1095A23855619770CE2F6C0803D2D166EC441E8E76738198F528BF11EB3DBDABB82119B
Submitted as: 9a0cff83cfcefe60ce799c3b8c0c11b5459f676a8c30ee968d4cc427259ab7b8
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\A851.tmp - adc6c4fa1665a69cafe848c98c8802b4a2930da7cb1de45a343fdb4da1743ef8
7479d4e526d1f218411d1f12e4358d85763596bfab7d2cd2dad36526f6cbf10a - 7479d4e526d1f218411d1f12e4358d85763596bfab7d2cd2dad36526f6cbf10a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787815291&P2=404&P3=2&P4=b%2f%2b6Sf%2f0IRXFogv4mWHSnTeJAPBDEGlA%2bdAfluZisKX2FqzgvsVimjv7Q%2b6q%2fmYsT%2b%2fzXGtGGibow8TRVZRoWA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787815353&P2=404&P3=2&P4=DGsMM%2flt5l9jjP92p3hnLE%2bIsSBOysw3quH7Digj8TrP5L3ZQuHFGFjOwDlmEnNpbkZieVg5XvX2cX9fAdzPgw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.115
48.211.4.16
4.230.171.124
20.247.184.197
85.210.196.11
74.178.76.128
135.233.95.135
20.42.65.90
20.231.239.246
52.123.128.14
52.123.129.14
4.150.223.100
172.178.240.161
52.123.252.234
74.178.76.44
52.110.12.3
52.110.12.31
203.26.79.13
52.148.114.188
125.56.205.17
125.56.205.105
92.223.78.30
72.153.5.133
52.110.12.11
52.110.12.1

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report