MALICIOUS — 9a54b192d5ee28d90527cb5b60670f0adce9811e2997b832b3afa6e2e09a39a0

MALICIOUS — 9a54b192d5ee28d90527cb5b60670f0adce9811e2997b832b3afa6e2e09a39a0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Salgorea family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 9a54b192d5ee28d90527cb5b60670f0adce9811e2997b832b3afa6e2e09a39a0
SHA-1: 77928f0d491bc3603107dc592fb4b385e123d8e1
MD5: 50edd916d7206f94ff914fc2467b85fe
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10ddV7r2DcyBHBrW/0HCjhcJrOIIq82PljVFsDE:Qoa1taC070ddt2gyBHigl5O52PJWwZ
TLSH: T1D15A239A1A1D3B0CE6F6C5447C59126E8441E4F7A37825CF818BF14EB3CA5677C202AB
Submitted as: 9a54b192d5ee28d90527cb5b60670f0adce9811e2997b832b3afa6e2e09a39a0
File type: pe · Size: 1958408 bytes
Verdict: malicious (99/100) · Family: Salgorea

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ic (rule Backdoor.Win32.Salgorea.ic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

151 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\4958.tmp - 26a5e31ce1edf8f203d2ac7849afd01ebeb9bd8c7012fd48c63f2b2ef2d9555e
cbaba3d08873c524e27df9afe56e37a6faf90dfdd6e03f758163744eb64096ac - cbaba3d08873c524e27df9afe56e37a6faf90dfdd6e03f758163744eb64096ac

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.97
4.230.171.124
4.247.188.224
40.84.85.40
52.230.60.54
74.178.240.51
20.42.73.24
135.232.92.137
20.42.72.131
104.18.33.89
172.66.2.5
52.110.12.44
52.110.12.38
92.223.78.30
4.150.223.113
20.42.65.89
72.145.35.111
52.148.114.188
52.110.12.24
52.110.12.19

File paths

n:\5o

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report