MALICIOUS — df8841187fcd03d9f7d9a326fa0cd35b2922be13df096700457130a20f2abe06

MALICIOUS — df8841187fcd03d9f7d9a326fa0cd35b2922be13df096700457130a20f2abe06 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Salgorea family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: df8841187fcd03d9f7d9a326fa0cd35b2922be13df096700457130a20f2abe06
SHA-1: 3b03b5058d6c095bf7b40f1b44e631c1dc427c7b
MD5: 5c70010b0a7888024d26c1f6c3cbed49
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dxiwbTjHamc15Sv1NqFMYXDE6qc:Qoa1taC0MbZcuvrqiYXDSc
TLSH: T1565A235646196B0CE6F6C8847C2A16AEC041D8E75338254F81CFF05EA3DBA7B78211DB
Submitted as: df8841187fcd03d9f7d9a326fa0cd35b2922be13df096700457130a20f2abe06
File type: pe · Size: 1958408 bytes
Verdict: malicious (99/100) · Family: Salgorea

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ic (rule Backdoor.Win32.Salgorea.ic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

150 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\B3F9.tmp - ce3b93077cbce3c504aab259b9d9b9274c2fdf0e3563d755bd73c9c70de38f41
5acd01bf0446f4f1f6e53428a9f47c7db69df55dfd3a073ef54760a62501b30a - 5acd01bf0446f4f1f6e53428a9f47c7db69df55dfd3a073ef54760a62501b30a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

e.sg
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.5
74.178.240.61
4.150.223.112
135.232.92.97
4.230.171.124
172.215.188.232
52.253.84.76
52.123.252.212
52.110.12.50
52.110.12.37
104.18.33.89
40.79.150.122
20.50.73.5
52.148.114.188
72.153.5.62
92.223.78.30
52.110.12.25
52.110.12.24

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report