MALICIOUS — d437303fc1199eac815123eff15ee3f7df990f897e6470f37fff3ead427ae804

MALICIOUS — d437303fc1199eac815123eff15ee3f7df990f897e6470f37fff3ead427ae804 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d437303fc1199eac815123eff15ee3f7df990f897e6470f37fff3ead427ae804
SHA-1: 753d68bff0e1c30c7ba17d8d599a56bdbc686941
MD5: 9d7f53a820d4e085b40ddeee86ea36b2
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dPQLxGcGeA97SRd5Hl3v/1S:Qoa1taC0EQLo92HN1S
TLSH: T1BC5A2346564C660CE3F6C4403D29126E9882F8B7A378248F41CFF19EB3DB967782159B
Submitted as: d437303fc1199eac815123eff15ee3f7df990f897e6470f37fff3ead427ae804
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\A207.tmp - b6ab73ebd128fbc847de4a85bfd46ea41c8a5fa80ac93be3a3ca4732e0c5b428
16c02e422bbc3fad9f35c7bf126d5472cc25560507bd644536201017a098b724 - 16c02e422bbc3fad9f35c7bf126d5472cc25560507bd644536201017a098b724

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787831772&P2=404&P3=2&P4=HuXuG7qZraGPAWECkJHicfbkNvHcDPbPqM1jnrSt2%2fGNjnnREhkQC07VCdzmDhoOxvhyaxzOb%2b0li6k0v5Ipaw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787831828&P2=404&P3=2&P4=P6gIzWoEvNCPslnnRIRe952MHwP8CD%2fQvT6hSKk8p8O1phI8%2fYnWL1jCim3ndSAM46Gvv0JAVzPhpEz8%2fTZ7LQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

9.kr
schemas.microsoft.com

Embedded IP addresses

20.184.175.10
4.144.132.223
172.215.188.232
4.230.171.124
135.233.95.144
135.233.95.135
20.42.73.26
4.150.223.107
20.112.250.133
40.103.64.242
52.123.129.14
172.178.240.163
203.26.79.13
74.178.76.44
52.148.114.188
40.79.167.9
72.145.35.107
85.210.196.11
4.247.188.224
52.110.12.4
52.110.12.40

File paths

C:\P&
M:\m.g

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report