MALICIOUS — f53d953957fbc28a0b92295972b34364f39f7598b27efe5c4ae29220d1d28b28

MALICIOUS — f53d953957fbc28a0b92295972b34364f39f7598b27efe5c4ae29220d1d28b28 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: f53d953957fbc28a0b92295972b34364f39f7598b27efe5c4ae29220d1d28b28
SHA-1: 3feaa7875ac44f1361b6b535b2e2bc4663d0fdb3
MD5: af2604d4c43bcfda4e23fd8648f101b7
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFjvBCq5Osrp46jYaOXXwv1KOfwgb0PmaZyGc:O+K88uPCH5M2zOwvoOIrmWyGc
TLSH: T1AD5A23859A299B0DE2F2D58038162AAEC042F5DB977C0989438FF11D73E74BB7831197
Submitted as: f53d953957fbc28a0b92295972b34364f39f7598b27efe5c4ae29220d1d28b28
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

98 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\8DA0.tmp - 39159accea19d3608fba73752c8e06d9ab92f9e4e6cbc00d27d9968036a55a76
431a6f5f80943913fd760cb9600871dd28780408b3a543eafa4822c325c551a2 - 431a6f5f80943913fd760cb9600871dd28780408b3a543eafa4822c325c551a2

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787812575&P2=404&P3=2&P4=SsFYr8yAUgsU%2bFL0tei4IryG4Npu3DxHiFxwGEKOhyxRZMzGOxKw2c1CQvNn%2bTYK45%2bzzuJBuDf9RhM4iwiMig%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787812605&P2=404&P3=2&P4=AtU3rqKFWP8aVhZ37HImvPiior688SK%2bcQIUhdB3Gn6iH%2bBlS8bKM5E9VWGQapbFgvWj6jutgXAUtir7tMANKw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.115
52.123.252.248
20.42.179.204
4.230.171.124
20.247.184.197
135.232.92.137
52.231.23.200
74.179.77.164
20.236.44.162
52.123.129.14
52.123.128.14
40.99.133.242
4.150.223.96
135.234.160.246
52.123.252.230
74.178.76.44
203.26.79.13
52.110.12.50
52.110.12.54
52.148.114.188
92.223.78.30
125.56.205.8
125.56.205.17
135.233.45.222
72.145.35.108

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report