MALICIOUS — e0f43d58dd7e61d5a5fdcc8f825608e6817f0408a492658e45311620da02aefe

MALICIOUS — e0f43d58dd7e61d5a5fdcc8f825608e6817f0408a492658e45311620da02aefe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Salgorea family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e0f43d58dd7e61d5a5fdcc8f825608e6817f0408a492658e45311620da02aefe
SHA-1: 3bb5d7bf3c403775d9d215bd65547c36301d7df7
MD5: 43b3fef360c941f062d11c85d10994e9
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d484yAmRGD00NBl97OiqwZWsQ0AVw9HAnGuN4:Qoa1taC070d48X0F+wdlAqFAGgKc+vx
TLSH: T19C5A238A4318370DE2F8C5906C59176DC442D8E7A778164AC28FF15EBBCB9A738112DB
Submitted as: e0f43d58dd7e61d5a5fdcc8f825608e6817f0408a492658e45311620da02aefe
File type: pe · Size: 1958408 bytes
Verdict: malicious (99/100) · Family: Salgorea

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ic (rule Backdoor.Win32.Salgorea.ic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

150 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\71A1.tmp - f4bfbb7a887e0c78ac3c7bfcadd12d3eb0e13761965676fd9e71f37402fb6e92
f5751ad09f02fd5b89bc4e6e69d551af596c5af69463c6f9ea9cecdfd86668a5 - f5751ad09f02fd5b89bc4e6e69d551af596c5af69463c6f9ea9cecdfd86668a5

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

m.pw
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.175
20.42.179.192
4.230.171.124
57.155.101.212
172.215.188.232
74.178.76.54
20.165.94.63
52.230.60.54
104.18.33.89
74.179.77.204
52.110.12.52
52.110.12.18
125.56.205.24
125.56.205.123
72.154.7.17
52.148.114.188
52.110.12.25
52.110.12.4

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report