MALICIOUS — b0eb6a01949f4d8469fd66ffb4c8fda9214c478a1b8a0e30b3011d5334398d2d

MALICIOUS — b0eb6a01949f4d8469fd66ffb4c8fda9214c478a1b8a0e30b3011d5334398d2d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b0eb6a01949f4d8469fd66ffb4c8fda9214c478a1b8a0e30b3011d5334398d2d
SHA-1: 2365a4871a73c4a99daa52ef2ec58d49f06e542a
MD5: 2b17ad160c34ab1fde894fa78ffdb12d
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dAd9HH8pnodN/h3Dzr0V8Qnnp9:Qoa1taC0LPcNodN1DzrQnj
TLSH: T1FF5A235A5619B70CE2F6C480696A266EC441E8F7A378298F81CFF04EB7CB857741109F
Submitted as: b0eb6a01949f4d8469fd66ffb4c8fda9214c478a1b8a0e30b3011d5334398d2d
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2CA8.tmp - 2278a5e7256f3b67dfb14be0f2de6ece658d78efb44ed062769fd716238c89af
5d2f26ac36911f96e28c6ef6327df387e06e536f2e67b2df43913563012b4c32 - 5d2f26ac36911f96e28c6ef6327df387e06e536f2e67b2df43913563012b4c32

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787791284&P2=404&P3=2&P4=mQuleKEmdRNrV4azoyTJ%2f5sS7YfXbK9Yvg1nEZx5wSe8IAKdZ3k3FOHfwV9ki6xLlLuzORGxcDZ%2fUQRBdoLG6A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787791323&P2=404&P3=2&P4=K%2fUJJ%2fIqNYR%2fgTDskz65NcZTaUaBEFfdjPFM%2fsKk9FMaymQobDtaQkh2qTzCLDu4tdeF38fA8KB0wLMehhYULg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.123.252.203
20.50.201.206
4.230.171.124
52.230.60.54
85.210.196.11
20.165.94.63
74.178.240.51
52.138.229.67
52.123.128.14
20.76.201.171
40.99.133.226
52.123.129.14
52.168.117.174
172.178.240.162
203.26.79.13
52.148.114.188
135.232.92.34
92.223.78.30
135.233.95.80
72.145.35.109
52.110.12.2
52.110.12.44

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report