MALICIOUS — a3f6f680ba8129fedf0ffd4b6a0ed1a7d6db0a21e40d39938f565c83ee9dcac5

MALICIOUS — a3f6f680ba8129fedf0ffd4b6a0ed1a7d6db0a21e40d39938f565c83ee9dcac5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Salgorea family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: a3f6f680ba8129fedf0ffd4b6a0ed1a7d6db0a21e40d39938f565c83ee9dcac5
SHA-1: 11cadd04bb1fe7595c89b87406986451a0667a56
MD5: ec7d29b82445cd77108d396af3b94e91
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dauH5MbtDXlNmvd4ivKGlhx:Qoa1taC005MzNm1niGN
TLSH: T17A5A23964109AB0CE2F5C5847D1D165EC442E8F7A37825CE828FF11EBBDB927382119B
Submitted as: a3f6f680ba8129fedf0ffd4b6a0ed1a7d6db0a21e40d39938f565c83ee9dcac5
File type: pe · Size: 1958408 bytes
Verdict: malicious (99/100) · Family: Salgorea

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ic (rule Backdoor.Win32.Salgorea.ic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5772) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

150 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\F925.tmp - 5d06bd4719e781e06cb719c04b74bf1e8e5cb35fd9617ba21faee956c0b02ac6
d345879f7f4ff5f220d3871b763db4020d15edef62fe2e5475aafecae802d3c8 - d345879f7f4ff5f220d3871b763db4020d15edef62fe2e5475aafecae802d3c8

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.207.44.69
52.123.252.244
4.230.171.124
57.155.104.224
20.247.185.124
20.165.94.54
20.165.94.63
4.150.223.110
52.253.84.76
4.144.132.223
4.144.132.114
52.110.12.55
52.110.12.18

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report