MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3483fe37e2e76078baf3aa19bd3709bed4c8ce95757debb368c4415009a5a24e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ServHelper


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3483fe37e2e76078baf3aa19bd3709bed4c8ce95757debb368c4415009a5a24e
SHA3-384 hash: eaedd999f576d5827910c69c36829c754cbd9265d4aa1b8bf00fe079b68ca3e34fddcb9c1af1f1e36d973a77e71959e7
SHA1 hash: 545325f4fead17fff4d2ca97ab78f75837f8dd59
MD5 hash: cbaa090104209f49dd1711191f93381e
humanhash: india-sink-blossom-yellow
File name:cbaa090104209f49dd1711191f93381e.exe
Download: download sample
Signature ServHelper
Create hunting rule
File size:6'340'608 bytes
First seen:2021-04-05 19:21:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4035d2883e01d64f3e7a9dccb1d63af5 (47 x ServHelper, 20 x LummaStealer, 17 x Rhadamanthys)
ssdeep 49152:kUlCX5h1mLjAzcvG53voOaks2oU8vaQmNpcvYm75UPCiYN3KVTniUXOP4ErwU1p:cXb1mXA4nDr
TLSH 4F56E012B8D208FAC17EE1708596936176727CA487323BD72EC4766A1AB5FE42F3D314
Reporter abuse_ch
Tags:exe ServHelper


Avatar
abuse_ch
ServHelper C2:
https://daspgpbjbj4ggg.xyz/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'710
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cbaa090104209f49dd1711191f93381e.exe
Verdict:
No threats detected
Analysis date:
2021-04-05 19:34:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5f6fa7d3-eb53-4e0c-9ab7-ee4279673a1f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/132433/
Detection(s):
Win.Malware.Bulz-9847817-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the system32 subdirectories
Creating a window
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Using the Windows Management Instrumentation requests
Forced system process termination
Launching the process to interact with network services
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/666401
Signature
Adds a new user with administrator rights
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Creates a Windows Service pointing to an executable in C:\Windows
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Sigma detected: Dot net compiler compiles file from suspicious location
Uses cmd line tools excessively to alter registry or file data
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 382131 Sample: ujgEp0DfKi.exe Startdate: 05/04/2021 Architecture: WINDOWS Score: 92 43 Antivirus detection for dropped file 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Sigma detected: Dot net compiler compiles file from suspicious location 2->47 49 Yara detected Costura Assembly Loader 2->49 8 ujgEp0DfKi.exe 5 2->8         started        process3 signatures4 51 Bypasses PowerShell execution policy 8->51 11 powershell.exe 44 8->11         started        process5 file6 37 C:\Windows\Branding\mediasvc.png, PE32+ 11->37 dropped 39 C:\Windows\Branding\mediasrv.png, PE32+ 11->39 dropped 41 C:\Users\user\AppData\...\zsitqx2k.cmdline, UTF-8 11->41 dropped 53 Uses cmd line tools excessively to alter registry or file data 11->53 55 Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes) 11->55 57 Adds a new user with administrator rights 11->57 59 Powershell drops PE file 11->59 15 reg.exe 11->15         started        18 csc.exe 11->18         started        21 powershell.exe 11->21         started        23 6 other processes 11->23 signatures7 process8 file9 61 Creates a Windows Service pointing to an executable in C:\Windows 15->61 35 C:\Users\user\AppData\Local\...\zsitqx2k.dll, PE32 18->35 dropped 25 cvtres.exe 18->25         started        27 conhost.exe 21->27         started        29 conhost.exe 23->29         started        31 conhost.exe 23->31         started        33 net1.exe 23->33         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3483fe37e2e76078baf3aa19bd3709bed4c8ce95757debb368c4415009a5a24e/
Threat name:
Win64.Trojan.WinGoGoCLR
Create hunting rule
Status:
Malicious
First seen:
2021-04-05 19:22:12 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gsb74n7c45qhroxtvim32nyjx3kmrtuvov66xm3iyravacnfujha._file
Result
Malware family:
servhelper
Create hunting rule
Score:
  10/10
Tags:
family:servhelper backdoor discovery exploit persistence trojan upx
Link:
https://tria.ge/reports/210405-zwszklvw16/
Behaviour
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Modifies registry key
Runs net.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Loads dropped DLL
Modifies file permissions
Blocklisted process makes network request
Modifies RDP port number used by Windows
Possible privilege escalation attempt
Sets DLL path for service in the registry
UPX packed file
Grants admin privileges
ServHelper
Malware Config
Dropper Extraction:
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Unpacked files
SH256 hash:
3483fe37e2e76078baf3aa19bd3709bed4c8ce95757debb368c4415009a5a24e
MD5 hash:
cbaa090104209f49dd1711191f93381e
SHA1 hash:
545325f4fead17fff4d2ca97ab78f75837f8dd59
Link:
https://www.unpac.me/results/411a6080-040e-4983-a75c-8ad8e9450b6d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3483fe37e2e76078baf3aa19bd3709bed4c8ce95757debb368c4415009a5a24e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_TOOL_GoCLR
Create hunting rule
Author:ditekSHen
Description:Detects binaries utilizing Go-CLR for hosting the CLR in a Go process and using it to execute a DLL from disk or an assembly from memory
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:susp_winsvc_upx
Create hunting rule
Author:SBousseaden
Description:broad hunt for any PE exporting ServiceMain API and upx packed
Rule name:win_servhelper_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ServHelper

Executable exe 3483fe37e2e76078baf3aa19bd3709bed4c8ce95757debb368c4415009a5a24e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1083192/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/132433/

Comments