MALICIOUS — d1d1d03a7041277541cc55593a8dda17078ac74b425f095ccbf804e567f6d82a

MALICIOUS — d1d1d03a7041277541cc55593a8dda17078ac74b425f095ccbf804e567f6d82a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d1d1d03a7041277541cc55593a8dda17078ac74b425f095ccbf804e567f6d82a
SHA-1: 68ea2892badd28fd69b93ffb438df77ffea60588
MD5: bf7240f3057d12367af738ea6fda3a6f
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFEhggfCGBEBxWI/lyznmN2ivVIwyGc:O+K88uPCHehgY/I/unmXyGc
TLSH: T1485A23855A25CB0CE2F2C8903C0D66BD8251B4D6867D0DCA934FF12E73DB96B643219B
Submitted as: d1d1d03a7041277541cc55593a8dda17078ac74b425f095ccbf804e567f6d82a
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

98 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2584.tmp - 00e32410a51291987f3b36f1e16a052e60ba97a57409e8beb26785eb4ff88a9c
c55323f378be22a03f812eb8022adfe3e1854ca952b8059023810d6e564e9bdc - c55323f378be22a03f812eb8022adfe3e1854ca952b8059023810d6e564e9bdc

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787946385&P2=404&P3=2&P4=Zp12eAz5gRgDT%2ffFe5o2Sg0ZSa3%2fewVs25i38QU1BzL3aNcVfeTceKCDZaKIoKGLH8nfgQG5hOy0tAAevbzeSA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787946453&P2=404&P3=2&P4=EwgGMp3KdHwbbQqCP2s5TolRpF0oLtRDJ0Kp3qYZLt3tp6pNHQmQaj%2fwO7aii7TFuQSb2quRFMUz3DqN0c3jPA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

z.fi
schemas.microsoft.com

Embedded IP addresses

51.132.193.105
48.211.4.16
4.230.171.124
20.247.184.197
74.178.240.61
135.233.95.135
20.42.73.30
57.155.104.224
20.231.239.246
52.123.129.14
52.123.128.14
20.50.80.215
135.233.45.222
52.123.252.236
52.123.252.219
20.165.94.46
13.89.179.15
52.168.117.175
203.26.79.13
162.159.142.9
52.148.114.188
72.145.35.110
52.110.12.1

File paths

l:\f1

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report