Overview

overview

10

Static

static

cb3cc55156...69.exe

windows7_x64

1

cb3cc55156...69.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb3cc551561883ab8fc4fb6fc837a469.exe

  • Size

    4.0MB

  • Sample

    211010-n46ggafgf8

  • MD5

    cb3cc551561883ab8fc4fb6fc837a469

  • SHA1

    f74ae6d243342099d3fa500cbc630f4a244a8d82

  • SHA256

    ee5d82cd5e61b518572b4415797ee407cff1d28a2e0b43a2baec7236c37695eb

  • SHA512

    b97782f7835949ec41da357cfba598936bc2542fa53c0c8da7f35168f4f0fe19158a5946a297dcc540b7ce0dda8aeacd06f69ac209bd562e58fb31924e8fd7d1

Score
10/10
servhelperxmrigbackdoorminerpersistencetrojan

Malware Config

Targets

    • Target

      cb3cc551561883ab8fc4fb6fc837a469.exe

    • Size

      4.0MB

    • MD5

      cb3cc551561883ab8fc4fb6fc837a469

    • SHA1

      f74ae6d243342099d3fa500cbc630f4a244a8d82

    • SHA256

      ee5d82cd5e61b518572b4415797ee407cff1d28a2e0b43a2baec7236c37695eb

    • SHA512

      b97782f7835949ec41da357cfba598936bc2542fa53c0c8da7f35168f4f0fe19158a5946a297dcc540b7ce0dda8aeacd06f69ac209bd562e58fb31924e8fd7d1

    Score
    10/10
    servhelperxmrigbackdoorminerpersistencetrojan

    • ServHelper

      ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

      trojanbackdoorservhelper

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies RDP port number used by Windows

    • Sets DLL path for service in the registry

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks