MALICIOUS — f08fa97d91c3f65bbd26310ba5fe0e90d4c52c42da7bfb4b934b3ec5fb64fe06

MALICIOUS — f08fa97d91c3f65bbd26310ba5fe0e90d4c52c42da7bfb4b934b3ec5fb64fe06 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: f08fa97d91c3f65bbd26310ba5fe0e90d4c52c42da7bfb4b934b3ec5fb64fe06
SHA-1: 08bfe61d7fb51fb28a6b1faf90ef04161aed07b6
MD5: f428464a0f07192812883c77b2ff05b1
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFAWgwFksfeQuXutRuPQgT2nlsyGc:O+K88uPCHXRuPQ3lsyGc
TLSH: T1A05A23D61A19970CE2F2C590381977BEC042E4D6C3BC598A128BF12D77DB86B783119B
Submitted as: f08fa97d91c3f65bbd26310ba5fe0e90d4c52c42da7bfb4b934b3ec5fb64fe06
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

98 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\B125.tmp - 80a14e5a93da21f0d5b93b27ae52c222d6a6ebf79ab654d16b0240c65bebc569
e69ad1953013947289256fe1c0165b2ac0b646176edcc449e3242ddf1e6dcb45 - e69ad1953013947289256fe1c0165b2ac0b646176edcc449e3242ddf1e6dcb45

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787746464&P2=404&P3=2&P4=m8ztuDbQxG1YO6OmWW599XaZ4BeJRuO%2foKREIGvh%2bsdS%2f8RYOS0ln8n07%2b1mqOvTojh%2fskvQD1rYkpbSs9ucjQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787746479&P2=404&P3=2&P4=gCIRpZqUgPxjL%2fAarqlLsUbjbbn1TKSJZxRd39PdS%2fxze8a9OlA44eraWQxDraATHRNkMQ1WO%2bHVHoWzyltcOg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.103
4.230.171.124
57.155.104.224
4.144.132.223
74.179.77.204
135.232.92.97
20.184.175.1
52.123.128.14
20.76.201.171
52.123.129.14
20.165.94.46
135.233.45.222
172.66.2.5
74.178.76.44
203.26.79.13
52.148.114.188
135.233.45.221
4.150.223.111
72.145.35.101
20.42.73.28
172.175.111.170
52.110.12.46

File paths

h:\y$

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report