MALICIOUS — afedd244ddfb7af0ad8adbe82aa5eda22eb38a9ec74eaf525e69b06afdf5871d

MALICIOUS — afedd244ddfb7af0ad8adbe82aa5eda22eb38a9ec74eaf525e69b06afdf5871d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Salgorea family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: afedd244ddfb7af0ad8adbe82aa5eda22eb38a9ec74eaf525e69b06afdf5871d
SHA-1: 001f3eab221198f0c0fcd1d46e5ddb70699014aa
MD5: e3a459e1e9969f53513e5c28cfb7f79b
imphash: c9b6c3da312e87a7377bab0dcbaf2d4a
ssdeep: 24576:SypW9SgLNZaOdcTMuUvxIg7toRMXNa0DiCHZVYEde+VIY9CEf/Vh/w0R0HP/:St9SgLNZa6xIq7HDi2V/IYcEHQf/
TLSH: T1C75433302415EC88CAC30F56962B5B9F4A93DBE5D43CAD4F65D2F03649049B3EE930A6
Submitted as: afedd244ddfb7af0ad8adbe82aa5eda22eb38a9ec74eaf525e69b06afdf5871d
File type: pe · Size: 1108132 bytes
Verdict: malicious (97/100) · Family: Salgorea

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Petite 2.4
Kaspersky (KVRT): Backdoor.Win32.Salgorea.id
Microsoft Defender: Trojan:Win32/Salgorea.VRR!MTB

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 8 weighted signals:

Dropped a malicious payload (Zusy): c6a6a0703c61c23372f079de79ee01f6cfdd97b2428d30855a5c4d7424512027 - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (12 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Petite 2.4 (rule DIE:Petite 2.4) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:, Petite 2.4 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

160 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/26460/files/c6a6a0703c61c23372f079de79ee01f6cfdd97b2428d30855a5c4d7424512027 - c6a6a0703c61c23372f079de79ee01f6cfdd97b2428d30855a5c4d7424512027
cdab9660cf25db7302b108a6c280b4af5d8f8d9271b48d554c3e76f34b7a51f2 - cdab9660cf25db7302b108a6c280b4af5d8f8d9271b48d554c3e76f34b7a51f2
6d5688e8c2bc105ab282adf14dda5805c892867d9424bff40902386d98d8e0e2 - 6d5688e8c2bc105ab282adf14dda5805c892867d9424bff40902386d98d8e0e2
ff122dfa4e72d53b032ba1be691f4e73925c8959a747e8af8d4eaa4388ac72a5 - ff122dfa4e72d53b032ba1be691f4e73925c8959a747e8af8d4eaa4388ac72a5
d768e3777aa8d33a3dab6334a8dff209eeeb4aeb5834bce31bee9a596c1169e1 - d768e3777aa8d33a3dab6334a8dff209eeeb4aeb5834bce31bee9a596c1169e1

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.231.239.246
52.110.12.30
20.42.73.31
172.215.188.232
52.230.59.222
4.150.223.97
74.179.77.204
40.84.97.4
172.178.240.163
20.42.179.192
20.42.65.94
4.230.171.124
52.148.114.188
52.110.12.53
20.236.44.162
52.110.12.26

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report