MALICIOUS — adf15447349cbbafd8568ab33c43bf9487751cf3fd84beb0e814f7f6632d6eb8

MALICIOUS — adf15447349cbbafd8568ab33c43bf9487751cf3fd84beb0e814f7f6632d6eb8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: adf15447349cbbafd8568ab33c43bf9487751cf3fd84beb0e814f7f6632d6eb8
SHA-1: 46d65123b5587fd14f524ede2fd1727908455600
MD5: f565566207e8bf650f4b9c8937bc2a54
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFXwuHbwZlKTdX7lf/XVS306WhJuS2biFjyGc:O+K88uPCHpwZnKRX7lFP6UJBXjyGc
TLSH: T11B5A23C25A299B08E7F7C5413C19666FC442F496A3BC498B428FF01E73DB46B70261A7
Submitted as: adf15447349cbbafd8568ab33c43bf9487751cf3fd84beb0e814f7f6632d6eb8
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

102 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\61B2.tmp - fe051d27c5680815cf9af973562614018159b1e5e47568d39d7abbf21507c80e
34171b3dfdf1bc5c810b73d4061e25e83db78a05a9759178700ab08e0352ae9e - 34171b3dfdf1bc5c810b73d4061e25e83db78a05a9759178700ab08e0352ae9e

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787832362&P2=404&P3=2&P4=N8RMySq9F8D30HTVpXtPacCiu%2fPssFHbp%2fGrlwdw3ai9KBS4wL6srCT5PBOSX1p7i255v4%2fulVawTQAqJBBXYA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787832449&P2=404&P3=2&P4=Yp5iY5Bjfb9zkRr6%2fokQoQw0Re2OHYCzd5LuOMViPyOnhpiTepQSdZYvp5gCL7rJ5Y1fuTNBKD7ah04NXFZ9QQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

x.tk
i.ga
schemas.microsoft.com

Embedded IP addresses

20.42.179.192
20.42.73.28
52.253.84.76
4.230.171.124
40.84.97.4
74.178.76.128
135.233.95.135
20.50.201.201
20.112.250.133
52.123.129.14
52.123.128.14
203.26.79.13
135.233.45.221
52.123.252.229
74.178.232.29
52.110.12.21
52.110.12.50
52.148.114.188
72.154.7.98
52.110.12.28
52.110.12.19

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report