MALICIOUS — a817aa7bb149aa58b640f0e5439fdc0848c39e3ec1e438591ac07a5b3cd97559

MALICIOUS — a817aa7bb149aa58b640f0e5439fdc0848c39e3ec1e438591ac07a5b3cd97559 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: a817aa7bb149aa58b640f0e5439fdc0848c39e3ec1e438591ac07a5b3cd97559
SHA-1: d405a3de93c4f8d6db90007b5e08c77d3ff13514
MD5: 31b5f985fe2079cd37dda8b052b3a9d8
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dQt5Pa7n5TBSt+K+vJfKr+eNqzHJU30US2:Qoa1taC070dM5STBKwpKDN8+1
TLSH: T1245A23955756370CE6F6C4842C29127EC042E8EBA77C280A828FF05FB7C7A67781156B
Submitted as: a817aa7bb149aa58b640f0e5439fdc0848c39e3ec1e438591ac07a5b3cd97559
File type: pe · Size: 1958408 bytes
Verdict: malicious (96/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\627E.tmp - 8f8632288a7e5a00c0c35a34322d7f2aa75e7bf457e0e9acca1f4216a5737aad
ea563bc6d0e187ae5c56a493926e635a4042d734de1c49eeb380fc82fa4b0ebf - ea563bc6d0e187ae5c56a493926e635a4042d734de1c49eeb380fc82fa4b0ebf

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787948204&P2=404&P3=2&P4=KSKATl4Qxrgf9tIJH7C%2bmn6fuHMumUJ%2f0yTrK9N8FMl%2bvfkjxfMFMLRc0x%2f0BKMw7Wf%2bCB%2fEvB60tEHL0jizxg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787948268&P2=404&P3=2&P4=JPZwVOG80kst6PoPtA4mTQBp50NP80MMtWL1MPH2JBFLkxv2Bn2Mf0lVntQiM11IfdtWELoVEur50o7bOceSVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.247.188.224
52.168.117.174
4.230.171.124
20.247.185.124
135.233.95.144
20.50.73.14
74.178.240.51
52.123.129.14
20.112.250.133
52.123.128.14
20.52.64.201
135.234.160.245
52.123.252.238
74.178.76.44
203.26.79.13
52.148.114.188
184.84.165.171
40.84.85.40
92.223.78.30
72.154.7.100
52.110.12.10
52.110.12.50

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report