MALICIOUS — fab5ebeaf0e7c8e0a113c75667589b95fe65611b9cefdea992cb1090168404b8

MALICIOUS — fab5ebeaf0e7c8e0a113c75667589b95fe65611b9cefdea992cb1090168404b8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fab5ebeaf0e7c8e0a113c75667589b95fe65611b9cefdea992cb1090168404b8
SHA-1: 1f56f0132105c18f43471f934f832e5b741c4362
MD5: c940bfd4c59ec240f4bb0e52cc305100
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d5kyNSP3BdR0mS5pa6Clbx3cweHo0HrscmO:Qoa1taC0VNDR0mS5cBlbx3AHOcJ
TLSH: T1C75A23865609670DD7F6C484392836AE8402E4EB637C158B82CFF05DB7CB9677C2219B
Submitted as: fab5ebeaf0e7c8e0a113c75667589b95fe65611b9cefdea992cb1090168404b8
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

87 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\1C6.tmp - abc9fd206ffe16169d34a6e2c0c9222719e4ed99caf208759808e710f41833d5
aad0eb463f10e5a9d3de851b4e5a4a0f0b165eac14887a27ca3d56c223a95696 - aad0eb463f10e5a9d3de851b4e5a4a0f0b165eac14887a27ca3d56c223a95696

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787883975&P2=404&P3=2&P4=N%2fMJDOs5ZtE3IY9aARftErVe2JD6HNCa24zcQmloOAjyjkNyTQWqrHQiwSuMlE2W0vidV6beUjEBgsFzf0BnTg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787884033&P2=404&P3=2&P4=lPEUQPbL1lEFndUT8Z%2b5gFwfpO2vOYpvqrg%2bUirPMSn92LIJdzVCdUpTttxzaD2RCCi2i%2baGUQdnm0dAERqc5g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

sq.to
schemas.microsoft.com

Embedded IP addresses

4.150.223.103
4.230.171.124
48.211.4.16
52.253.84.76
74.179.77.204
135.233.95.135
13.89.179.12
52.123.128.14
20.112.250.133
52.123.129.14
203.26.79.13
172.178.240.161
52.110.12.49
52.110.12.26
135.233.95.80
52.148.114.188
40.79.167.10
20.42.73.26
92.223.78.30
72.153.5.137
52.123.252.222
4.209.250.170
52.110.12.1
52.110.12.50

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report