Overview

overview

10

Static

static

608b93e344...61.exe

windows7_x64

1

608b93e344...61.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    608b93e344bd3dbb09d0af9da6856061

  • Size

    4.0MB

  • Sample

    210914-rhbxhsaggq

  • MD5

    608b93e344bd3dbb09d0af9da6856061

  • SHA1

    b7c8bd7bace350d3c9c054ebb58f25535d22ee95

  • SHA256

    5d45cef43fb4c150c33337fb369a89800f9d235eee1dbdac13a8f6fd13bc1ee4

  • SHA512

    6e47bb4688737505af62a8c67cea4143185dc047340d8943d412b5274b229bd24628a31576a3250cdfb69b0b4fcfd74140fe83355f49527e7cf9f465c30ac131

Score
10/10
servhelperxmrigbackdoorminerpersistencetrojan

Malware Config

Targets

    • Target

      608b93e344bd3dbb09d0af9da6856061

    • Size

      4.0MB

    • MD5

      608b93e344bd3dbb09d0af9da6856061

    • SHA1

      b7c8bd7bace350d3c9c054ebb58f25535d22ee95

    • SHA256

      5d45cef43fb4c150c33337fb369a89800f9d235eee1dbdac13a8f6fd13bc1ee4

    • SHA512

      6e47bb4688737505af62a8c67cea4143185dc047340d8943d412b5274b229bd24628a31576a3250cdfb69b0b4fcfd74140fe83355f49527e7cf9f465c30ac131

    Score
    10/10
    servhelperxmrigbackdoorminerpersistencetrojan

    • ServHelper

      ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

      trojanbackdoorservhelper

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies RDP port number used by Windows

    • Sets DLL path for service in the registry

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks