MALICIOUS — f71285a090e5346d811be6fe331b390431a6e175fdd5c929faa123974b5ff7a3

MALICIOUS — f71285a090e5346d811be6fe331b390431a6e175fdd5c929faa123974b5ff7a3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: f71285a090e5346d811be6fe331b390431a6e175fdd5c929faa123974b5ff7a3
SHA-1: 58233ce2e513010d06f3e9f820c4e649b22d2962
MD5: 74c6f65f5f60ed5261980e8da8923309
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dTJ8Q7ZMpRmKVMTj0q3x8/bGS/JKy5:Qoa1taC08/sRfVM3OC4
TLSH: T1BE5A23495609370CF2F5C5882C26116EC442E8B69738298F91CFF15EB7DB93B78211AB
Submitted as: f71285a090e5346d811be6fe331b390431a6e175fdd5c929faa123974b5ff7a3
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\EDA2.tmp - 5db2039f86c9bab2b21cdbcc73fa784975f10620b5b759efa92e235a289e8f97
170dee80908b5d86f63d0405cb4156f7a80c7f5f942e973a1d609bc57968372a - 170dee80908b5d86f63d0405cb4156f7a80c7f5f942e973a1d609bc57968372a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850363&P2=404&P3=2&P4=HeTzj0gKCDVgjimsEnL3UUcI%2bJt0KlGDgYWnp7ppb9prZWGCv6D3bFdCdnzlhXzTcBvH0JxTbZVIt28%2bcAFQNw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787850416&P2=404&P3=2&P4=HUlcbBFz7TXoohQm5Jb71%2bq%2bI42gET0IsoL8jW1d2H16I5JCNb26Jw%2brsS6azRxGODa9i3ocHa%2b4jdsLW78ByQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.184.175.9
52.230.60.54
4.230.171.124
4.247.188.233
135.233.95.144
74.178.76.54
52.168.117.170
20.231.239.246
40.99.133.210
40.99.133.242
40.99.134.2
52.123.128.14
52.123.129.14
52.123.252.203
74.178.76.44
203.26.79.13
135.233.45.221
52.110.12.40
52.110.12.32
52.148.114.188
20.42.73.28
72.145.35.109
4.209.250.170
20.165.94.46
52.110.12.50

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report