MALICIOUS — ba17ab0492d0b8359808c85b09069ff9738a4bbc47cda0e2a5b49ec5cdaa14ea

MALICIOUS — ba17ab0492d0b8359808c85b09069ff9738a4bbc47cda0e2a5b49ec5cdaa14ea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: ba17ab0492d0b8359808c85b09069ff9738a4bbc47cda0e2a5b49ec5cdaa14ea
SHA-1: 8d052d1d852244ee72f0c6c152c58ddee2c620a3
MD5: 3c66ca120b4dff66344e1f0a546727f1
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFTIkIjFo4pgEtGxZdMh2LeH0cM73w6yGc:O+K88uPCHwZo4gEIFMmeH0cM73w6yGc
TLSH: T12A5A23C6A62A9709E2F6C5613C09267D8441E0D297BC0D8B938FF12D77EB46774320A7
Submitted as: ba17ab0492d0b8359808c85b09069ff9738a4bbc47cda0e2a5b49ec5cdaa14ea
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\18E2.tmp - 0b16d3436baea8dd95e1735a8e1d8d5856c4924ff47b49d931a030ad75a9e688
e4c076fdf56b36cff1374de7229a7f48b8b4f316240d92d5dedb491836832931 - e4c076fdf56b36cff1374de7229a7f48b8b4f316240d92d5dedb491836832931

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787940407&P2=404&P3=2&P4=MS6A4tDtaEdxkNKooBVzuxUv8PtYT61xiMDy8LHa5wMsynHhag0bqcW%2bT2xnboYV2fYqQf2%2b6K4TJ5eoCrWRRw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787940481&P2=404&P3=2&P4=U8%2bzBTkMT2nB8LqZFLPXn75ZvnCLb5u119Wz6xEejzne8gB63ArgpbClRdFHlhbgt124MUOZjzYY238RykmGlw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.168.117.168
4.230.171.124
20.42.179.204
52.230.59.222
74.179.77.204
74.178.240.51
4.150.223.106
20.112.250.133
40.99.134.2
52.123.128.14
52.123.129.14
40.99.134.18
51.105.71.137
135.234.160.245
52.123.252.226
52.148.114.188
52.110.12.33
52.110.12.19
203.26.79.13
135.232.92.34
162.159.142.9
20.42.179.192
52.123.252.215
92.223.78.30
72.153.5.62

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report