MALICIOUS — a5f728a08ee5dd5b97e131a6fa59027e1be708c5b88f17c5f1dc4c85465a8842

MALICIOUS — a5f728a08ee5dd5b97e131a6fa59027e1be708c5b88f17c5f1dc4c85465a8842 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: a5f728a08ee5dd5b97e131a6fa59027e1be708c5b88f17c5f1dc4c85465a8842
SHA-1: 70dcb67ec06a269133fad1ebb00ba390b8a0949e
MD5: 7c37e9a1cbab96b6e3df20f368855df4
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10daNk+R2ld0w+68htUqDEuduuccF4UMT0G5Qy3:Qoa1taC070d01UdPbstduuccuUiEKP
TLSH: T1CA5A224A671A6B0DD2F6C4803E18165DC842A8F7A378298F518FF05DB7D6D2B3C111AB
Submitted as: a5f728a08ee5dd5b97e131a6fa59027e1be708c5b88f17c5f1dc4c85465a8842
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\B2E0.tmp - 6434300f0ab9b84dd171fc382426b20d805ec0aa56e2cf1cdf5ec4091aa3a9d1
ef466313706c13fca0bfb79a7dde5efbbbd9ee3e823b3a17b571ef8e209cd464 - ef466313706c13fca0bfb79a7dde5efbbbd9ee3e823b3a17b571ef8e209cd464

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787821895&P2=404&P3=2&P4=nwRoHIf%2b015dkGq42Vi0XZE0BZDK%2beLmZ6C5yyvR87hQsWBVS16jeWEJCuaa2XKAPn51cw2qHUpilpRpfun8Mg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787821937&P2=404&P3=2&P4=htGQV606xa2CAttQpvErkmth5Ye8Ur2u4s%2bSYHry%2bPJ0VXV1BlWnxr7tzMXBdr06WgzFpc749GBpbBCWBiE0KA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

u.it
s4.se
schemas.microsoft.com

Embedded IP addresses

40.79.163.155
20.247.184.197
48.211.4.16
4.230.171.124
20.42.179.204
135.233.95.144
135.233.95.135
20.42.73.26
20.236.44.162
52.123.129.14
135.233.45.222
162.159.142.9
52.123.252.225
52.123.252.233
74.178.232.29
52.110.12.5
203.26.79.13
52.110.12.42
52.148.114.188
72.153.5.139
52.110.12.46
52.110.12.20

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report