servhelper

General

Target

40d10714cfb75e2f22c44fd44e85d1d0N
Size

7.1MB
Sample

240829-kt2travfmn
MD5

40d10714cfb75e2f22c44fd44e85d1d0
SHA1

79e291688ecb088468e0162b0685956be1206fbd
SHA256

1d35504c81463a2597916e4ea5448d45caee98ccc8557e256bcc05a567584b37
SHA512

98095c75bc12cc6a0f353f7d40155a44222dab25569ee736ab232f7c985ebfbf4ffb9fab80dd27e2c581729f571029ed6eaea61d5bac32ac1ac3566e7faf2e4b
SSDEEP

196608:ZJM3nfEyJ8X2RmnK0v0Ahh0yfcjkbMebHjgTF8R:Z2f6X2RFWhSyQe3sFS

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Targets

- Target
  
  40d10714cfb75e2f22c44fd44e85d1d0N
- Size
  
  7.1MB
- MD5
  
  40d10714cfb75e2f22c44fd44e85d1d0
- SHA1
  
  79e291688ecb088468e0162b0685956be1206fbd
- SHA256
  
  1d35504c81463a2597916e4ea5448d45caee98ccc8557e256bcc05a567584b37
- SHA512
  
  98095c75bc12cc6a0f353f7d40155a44222dab25569ee736ab232f7c985ebfbf4ffb9fab80dd27e2c581729f571029ed6eaea61d5bac32ac1ac3566e7faf2e4b
- SSDEEP
  
  196608:ZJM3nfEyJ8X2RmnK0v0Ahh0yfcjkbMebHjgTF8R:Z2f6X2RFWhSyQe3sFS
Score

10^/10

servhelper backdoor defense_evasion discovery execution exploit lateral_movement persistence trojan upx
- ServHelper
  ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
  trojan backdoor servhelper
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Remote Service Session Hijacking: RDP Hijacking
  Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
  lateral_movement
- Blocklisted process makes network request
- Indicator Removal: Network Share Connection Removal
  Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Server Software Component: Terminal Services DLL
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2