ServHelper

ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

SmokeLoader

Modular backdoor trojan in use since 2014.

suricata: ET MALWARE ServHelper CnC Inital Checkin

suricata: ET MALWARE ServHelper CnC Inital Checkin

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Grants admin privileges

Uses net.exe to modify the user's privileges.

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies RDP port number used by Windows

Possible privilege escalation attempt

Sets DLL path for service in the registry

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.