MALICIOUS — d487ce0864a28b2aef4a7b1e78e0a458bab5b11a13fcbb05fb60deacf281c17c

MALICIOUS — d487ce0864a28b2aef4a7b1e78e0a458bab5b11a13fcbb05fb60deacf281c17c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d487ce0864a28b2aef4a7b1e78e0a458bab5b11a13fcbb05fb60deacf281c17c
SHA-1: 20a9123cf3eade751cfc98681d18c7b76be7bf8d
MD5: bedeb7f568018976db1fe0c5f17608c2
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d2N/73o+6waKPni3Ax/lyNcxA7mY:Qoa1taC0K7xSNty5yY
TLSH: T1ED5A23468A186B0DE6F2C1843D29066E8481E4F76378258F92CFF16EF3C7967781119B
Submitted as: d487ce0864a28b2aef4a7b1e78e0a458bab5b11a13fcbb05fb60deacf281c17c
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\4522.tmp - 04b6ec8e6cfae23f1a317e412abe1f03b9dc77ec9188e3d1f267f5370c7194e0
a3691b431542a1133dbfc044d7c72e64c95ffa5ce415e632c6d40ec0c20d2625 - a3691b431542a1133dbfc044d7c72e64c95ffa5ce415e632c6d40ec0c20d2625

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787883673&P2=404&P3=2&P4=ikR7GUCZm%2fAk%2f4ow3NrPn8Oe71Rbj8Ut5XqRrmkzrsJqbwnmrMPHp2500BDHDvzIJljd561fMPqbuYF1Qw7V3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787883738&P2=404&P3=2&P4=dgo31yBordboyz8Yxr%2fRaaz8ufvvxsUIkpYfaHhPBlbQFn0dFQ3bFZ%2bl7Q6E8CwrQPu5CR5CYxUpmMbU%2bF0GRA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

u.nl
schemas.microsoft.com

Embedded IP addresses

51.104.15.253
57.154.63.210
4.230.171.124
48.211.4.16
4.144.132.114
74.179.77.204
40.79.163.155
20.165.94.54
40.103.64.242
20.76.201.171
52.123.128.14
52.123.129.14
51.11.192.50
135.233.45.223
203.26.79.13
52.123.252.213
135.232.92.34
52.110.12.2
52.110.12.54
52.148.114.188
52.182.141.63
20.42.73.31
72.153.5.61
52.110.12.45
52.110.12.15

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report