MALICIOUS — virussign.com_f6790123345e0a86560a620abaeffa10.vir

MALICIOUS — virussign.com_f6790123345e0a86560a620abaeffa10.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f026dc9d32aa393b9ca02960dc39dbed655eed46d820c066d46e833ea48a5d0f
SHA-1: 30f0b9dcdb88fb8d913548093dfae6e88003ba9a
MD5: f6790123345e0a86560a620abaeffa10
imphash: 6dca3e9fb3928bbdb54dbce669943ec8
ssdeep: 12288:wU5rCOTeiDT82b/ci3SeuLkN1P0timSNZ+3/v+I9hUG2VA:wUQOJDT8y/ciieumVmSNGEA
TLSH: T1704ED1CE5200E741D973AF6225546DCE24B278C294763E8C0BC2F03B16F5D27BC6A5A9
Submitted as: virussign.com_f6790123345e0a86560a620abaeffa10.vir
File type: pe · Size: 667648 bytes
Verdict: malicious (99/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Trojan.Cuegoe-6336261-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: TrojanDownloader:Win32/Upatre
Kaspersky (KVRT): HEUR:Backdoor.Win32.Salgorea.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.Cuegoe-6336261-0 (rule Win.Trojan.Cuegoe-6336261-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Cuegoe): ED49.tmp - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

2620 behavior events · 1 ATT&CK techniques · 29 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ED49.tmp - bd7cf152adcaf293623252be8f49c3eab04e620a24b901f593b8e4063375fb4b
C:\Users\analyst\AppData\Local\Temp\2F87.tmp - 84b52867189e73ebb3c60ad01a9c631839f79999be1f159c167feaea20aeeff7
C:\Users\analyst\AppData\Local\Temp\6EF1.tmp - 9db5a08b24bdac1c387efa2f107e14e83f44a8261c310ca18825a49bbd3414dc
C:\Users\analyst\AppData\Local\Temp\28FA.tmp - 8c9edaf958098e352591974c7a97b529de8322c9d0fc846b48fe6f1f70a44157
C:\Users\analyst\AppData\Local\Temp\D4DA.tmp - 87567061ca5846c29986c056a74cd3c108fe63aa061b8358dac4d974623684f5
C:\Users\analyst\AppData\Local\Temp\7692.tmp - c88c7a0bf569fd9d7da5a92e26d99bcb2969490be749a19f86c8c8bc225dbd13
C:\Users\analyst\AppData\Local\Temp\3718.tmp - d7acfba93a2e225d78db370cd3cc1073dc4611a9cc849312c51b2e8f2eae1c0f
C:\Users\analyst\AppData\Local\Temp\AC72.tmp - 35c061468221956d96235f377f670bd194b1c38d143322d8be909fc54f54dd1e
C:\Users\analyst\AppData\Local\Temp\862D.tmp - cd1623768f8d99d9a4b53577a381984148fd29b4a645524798f1e40a7546b037
C:\Users\analyst\AppData\Local\Temp\740D.tmp - 7e4bb1eb7ad411baca7becfc14f765f5c717d4aac90a26590351c454ed485715
C:\Users\analyst\AppData\Local\Temp\3DBF.tmp - 0162ed8fa82f44467412cbeaa6c24af320bb9703d793d7331812c2349915646a
C:\Users\analyst\AppData\Local\Temp\13F0.tmp - ef35c160e01b3eafe9cb117b8a6fbf420debdda0903b7bd1f139cfd8962f892e
C:\Users\analyst\AppData\Local\Temp\B149.tmp - 269093aaf37667f15f4ad1c9ee3469168f8543dd75d84e650b2ccffeb0f51111
C:\Users\analyst\AppData\Local\Temp\FC22.tmp - a092ceb8dfb226992cf180a72f0bb92aecea6331a5cb9e498a18d257d96b1127
C:\Users\analyst\AppData\Local\Temp\951.tmp - b61da3d6e72ea1292d3a0b22de1b5d804896b19f80bcaaf766e265308dd8e37d

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/ado/2007/08/dataservices/metadata
http://schemas.microsoft.com/ado/2007/06/edmx
http://schemas.microsoft.com/ado/2006/04/edm
http://schemas.microsoft.com/ado/2007/05/edm
http://schemas.microsoft.com/ado/2008/01/edm
http://www.w3.org/2001/XMLSchema-instance
http://schemas.microsoft.com/ado/2008/01/edm:OpenType
http://schemas.microsoft.com/ado/2008/09/edm
http://schemas.microsoft.com/ado/2006/04/edm/ssdl
http://schemas.microsoft.com/ado/2009/02/edm/annotation
http://schemas.microsoft.com/ado/2007/08/dataservices/scheme
http://www.w3.org/2005/Atom
http://www.w3.org/2000/xmlns/
http://schemas.microsoft.com/ado/2006/04/edm/ssdl:StoreGeneratedPattern
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787671616&P2=404&P3=2&P4=UlzbRn7ek%2fm1wBOkn68OyPGsjagBr1Xv2M9abr4OLNGrvpOjBB%2bXGvoWKbbc7ovZXmHyWzlnmbMjrfGQPK4jsQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787671711&P2=404&P3=2&P4=ESzsdLIqMRVXKiXGT1qNugs5wBYujnEFx5ygK5Spf1cFbF9XVN3DGlg%2fCHoOcS37qXBPFR3rzopLTN34PeBZWA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
www.w3.org

Embedded IP addresses

72.153.5.63
172.215.188.225
20.247.185.124
74.178.232.29
20.42.73.31
52.123.252.232
4.230.171.124
135.232.92.137
135.232.92.97
4.150.223.106
20.112.250.133
52.123.128.14
162.159.142.9
52.123.129.14
40.99.134.2
74.178.240.61
172.178.240.163
203.26.79.13
92.223.78.30
51.104.15.253
52.148.114.188
20.165.94.46
72.145.35.104
20.42.179.204
52.110.12.5

File paths

D:\:p:
f:\dd\tools\devdiv\EcmaPublicKey.snk
U:\:c:j:q:x:
P:\:d:

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report