Extracted

Extracted

• • Target

    df2cda7268742a64ff9f639ea838b375b3a0d12bcf01afec13bccafb8abdefe1

  • Size

    340KB

  • MD5

    a3462aada89ad7cc91f3850fbd41bd21

  • SHA1

    21029d650dd17a48c81c76f72d7c1c47dae9de46

  • SHA256

    df2cda7268742a64ff9f639ea838b375b3a0d12bcf01afec13bccafb8abdefe1

  • SHA512

    23177bd4fe2ad3a784371236cefd3775e17a008579db04226a9e6a5d68b3850d1d930fc7a5d7ba5e7a47b006c950a17e114b6c76ef524eecaf62926fac6982f8

  Score

  10^/10

  servhelpersmokeloaderxmrigbackdoorminerpersistencespywaretrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies RDP port number used by Windows

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  behavioral1