MALICIOUS — cb9f434c05eb23a47fc73f83594c7f2597d67fd54402aef826eb65b7807305cf

MALICIOUS — cb9f434c05eb23a47fc73f83594c7f2597d67fd54402aef826eb65b7807305cf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: cb9f434c05eb23a47fc73f83594c7f2597d67fd54402aef826eb65b7807305cf
SHA-1: 0fed5545ebce2cb136efd29d2a5a05209a93d0d1
MD5: 7cc1aa2e524040a4f6ed03b60068168a
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10duXEJCK6He6cSz+Y/1fuCJecEo3fTPrjoxu3F:Qoa1taC070dwjHemz+Y/1lIcEurxF
TLSH: T18C5A2346190DB70CD2F6C5847D6D226E8401E8F7A378198E828FF19EB3D7CA7A811197
Submitted as: cb9f434c05eb23a47fc73f83594c7f2597d67fd54402aef826eb65b7807305cf
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2367.tmp - 888bda72e748df4ee1538f5a76ee93f743c9659d364e6d738ea030494c66109f
355fb4475c6683779bbd326fa5d6bf358231c8046249c9d645f25de1a6409ac1 - 355fb4475c6683779bbd326fa5d6bf358231c8046249c9d645f25de1a6409ac1

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787849764&P2=404&P3=2&P4=WwS8Dgblj3VFT53aDrNVoUrWXHJXgUZ%2bNE1gQWVxcNE%2f7rTh3hX4vTQI5ISu8KI39vPx5XX4j54VoejiArYLaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787849824&P2=404&P3=2&P4=brbigsHpCu0NgcIfP1zt8WwXnaWlLzZbvSb6faWHRumj%2bpFvoY7car9vaXJ4zio1gUyVzhnbWpNKL%2fBcAJtJ7Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.113
172.215.188.232
4.230.171.124
74.178.240.61
74.179.77.164
57.155.101.212
52.230.59.222
52.230.60.54
20.42.65.91
20.76.201.171
52.123.129.14
52.123.128.14
40.99.134.2
203.26.79.13
74.178.76.44
92.223.78.30
135.233.45.221
52.148.114.188
72.153.5.62
51.104.15.253
4.209.250.170
52.110.12.28
52.110.12.26

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report