MALICIOUS — e6c8645e72e52bee3e43aee5f18dd7c25644abcb77e41d38f0a4ba4c0b94e569

MALICIOUS — e6c8645e72e52bee3e43aee5f18dd7c25644abcb77e41d38f0a4ba4c0b94e569 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e6c8645e72e52bee3e43aee5f18dd7c25644abcb77e41d38f0a4ba4c0b94e569
SHA-1: 2e00003d1d0681c48c2d8c86e90a340e76d9aa93
MD5: aa6afa1aeda32a6d13cb6f18d22f066c
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFl/vztU6iEWxVX9gMH4Q57u9nA9yGc:O+K88uPCH/vztUzVX6MYQ57u9A9yGc
TLSH: T15C5A23C64A295B48E7F6C8803819766DC241F5E5977C09CA428FF02D33EBA77706216B
Submitted as: e6c8645e72e52bee3e43aee5f18dd7c25644abcb77e41d38f0a4ba4c0b94e569
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\3757.tmp - e98d32ea1f53492c7bb38751f38b2fd813af441e7070abd0ffb5ba2e45cb3dad
28767a13092708234a9827c8747d91f4c67d23fe9065ffc66d20ffd05e69c51b - 28767a13092708234a9827c8747d91f4c67d23fe9065ffc66d20ffd05e69c51b

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787814077&P2=404&P3=2&P4=UqWg2GBc8oua3ASVkKZDDc256wB8LZu6wqYREsBPtAmnbArQxaMnTPpRNduRVO%2b%2fFxsLPcyQfJdVuati%2bPq22A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787814109&P2=404&P3=2&P4=gd52iXRlQVSkn%2bSZ3gDX8MtHX7SDGzoTCHHqx5hp1Rq1vQ%2fkJhfzcNi1MEH5hybYmjZvrJfI%2b9yDvsVdn56%2fRw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.109
85.210.196.11
20.247.185.124
52.123.252.247
4.230.171.124
20.42.179.192
74.179.77.204
74.179.77.164
20.42.73.26
20.231.239.246
52.123.129.14
40.99.134.18
52.123.128.14
52.182.141.63
135.234.160.245
52.123.252.202
52.123.252.229
135.232.92.34
203.26.79.13
52.110.12.3
52.110.12.48
52.148.114.188
125.56.205.59
125.56.205.17
72.153.5.140

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report