Extracted

• • Target

    3c657b42330d1a7ddf6242024474fbef_JaffaCakes118

  • Size

    7.3MB

  • MD5

    3c657b42330d1a7ddf6242024474fbef

  • SHA1

    d19ca0d611db42996dc850a1bb8ce3dead8994ee

  • SHA256

    0b1fbc02322659bf31999e38a60f832b9ff7a10f0d4866e026deef43ce963942

  • SHA512

    caa942525e80f5ed579654eb51e58d6b6ce8c03f357d53e03b14a0e5082d940f41075adaccba09853b5fabdee3756df62d4350ca4cd2e7093bd982ea01e2b68e

  • SSDEEP

    196608:5pqzDlif2GFRwd83gu5Bcl9tXyH/APnRxJY7DvtzLEu4i67b2A9tP:504FR0OgcBgaIPnRxJY7DVzLl4i6n2I5

  Score

  10^/10

  servhelperbackdoordefense_evasiondiscoveryexecutionexploitlateral_movementpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • Blocklisted process makes network request

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2