MALICIOUS — fd7236c9d7f212f40e70ffbdae54d5000502eb467b104e091305dfff7e834309

MALICIOUS — fd7236c9d7f212f40e70ffbdae54d5000502eb467b104e091305dfff7e834309 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Salgorea family. 4 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: fd7236c9d7f212f40e70ffbdae54d5000502eb467b104e091305dfff7e834309
SHA-1: 8d9d0d3b22fc7b3388876dc00125f232a969d1df
MD5: 5f2e2178737960aa2a36cf6964dae1e7
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dprCtawktn6R+whMwMK+aFMtFIJMvNlVx:Qoa1taC00LbtChiaFFc5x
TLSH: T1585A230A56497B0CE3F5C4846D2A136EE441E8E76338258F818BF15EB3EB9A76C110D7
Submitted as: fd7236c9d7f212f40e70ffbdae54d5000502eb467b104e091305dfff7e834309
File type: pe · Size: 1958408 bytes
Verdict: malicious (99/100) · Family: Salgorea

Detections (4 of 52 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (C83B492E): 01883093610f55b7513bd2c6cecf923d7d87f37d5a36f03c793485f1ec3eb712 - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 52 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/27084/files/01883093610f55b7513bd2c6cecf923d7d87f37d5a36f03c793485f1ec3eb712 - 01883093610f55b7513bd2c6cecf923d7d87f37d5a36f03c793485f1ec3eb712
5796d5c64bdaf5b9fba98c06482e9e268207e4755533a07d1164bc854cc2785a - 5796d5c64bdaf5b9fba98c06482e9e268207e4755533a07d1164bc854cc2785a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786980508&P2=404&P3=2&P4=J1Bh385oMDQ2XbPT7dmDQJ895Rx1GqrlAdHRzwJlslN6Zcev%2f7cSNG%2bUK4ScNdk2BKqnum%2fBO5n3pR7C712dug%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/1d8d0488-0a3b-440b-b2a9-36df2b9d4ebd/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/1d8d0488-0a3b-440b-b2a9-36df2b9d4ebd?P1=1786980619&P2=404&P3=2&P4=Rl3WAyeps%2fjcZTPNV9HZcvreURe8kgE%2bmakexc%2bWPwyyqSyW2qbAJu2rMg8tPlnh4xdI7AW8BaNam4qIPJgbqA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

f.ch
schemas.microsoft.com

Embedded IP addresses

142.250.195.227
20.42.179.192
13.89.179.12
52.123.252.233
172.215.188.225
4.230.171.124
20.247.185.124
74.178.76.128
135.233.95.135
4.150.223.107
52.123.252.222
72.154.7.104
135.233.45.222
104.208.16.94
20.112.250.133
52.123.129.14
52.123.128.14
52.148.114.188
92.223.78.30
52.110.12.5
52.110.12.20
203.26.79.13
74.178.76.44
48.211.4.16
85.210.196.11

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report