MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8962a3b3d7ed877d9642f72ad224101c528f965de1facb3ee87276cb144dfaf6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ServHelper


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8962a3b3d7ed877d9642f72ad224101c528f965de1facb3ee87276cb144dfaf6
SHA3-384 hash: 4882c9bd36e5c7f65408d3debc67db48703515f5bd46d2b98bb86685ae29c78c05cae3451eb5aa1c7f31af5db1c27fd4
SHA1 hash: 83441ce2d1782efe6789242a4f898517d904175a
MD5 hash: 67716e7c7b42b3c29d7ccddaa4cf85f4
humanhash: eight-whiskey-wisconsin-king
File name:67716e7c7b42b3c29d7ccddaa4cf85f4.exe
Download: download sample
Signature ServHelper
Create hunting rule
File size:6'340'608 bytes
First seen:2021-04-08 16:58:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4035d2883e01d64f3e7a9dccb1d63af5 (47 x ServHelper, 20 x LummaStealer, 17 x Rhadamanthys)
ssdeep 49152:UbuvlXqv//Ds4A2Qs5+9z40EFqBoaUje/OLHQXtli4D40C7Mj0Wt/gmbmnqZTcix:82XE//A4n+k
Threatray 84 similar samples on MalwareBazaar
TLSH F056E016BCD214FAC17AE1708556A3A27A713C64C7323BD72E84B66A1AB5FD42F3D310
Reporter abuse_ch
Tags:exe ServHelper

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'750
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
67716e7c7b42b3c29d7ccddaa4cf85f4.exe
Verdict:
No threats detected
Analysis date:
2021-04-08 17:00:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/61900c71-09f3-4c27-82ca-440951bfc988

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133281/
Detection(s):
Win.Malware.Bulz-9847817-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the system32 subdirectories
Sending a UDP request
Creating a window
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/670573
Signature
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Creates a Windows Service pointing to an executable in C:\Windows
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Sigma detected: Dot net compiler compiles file from suspicious location
Uses cmd line tools excessively to alter registry or file data
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 384231 Sample: GNurMQO1UI.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 96 41 Antivirus detection for dropped file 2->41 43 Multi AV Scanner detection for dropped file 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 2 other signatures 2->47 8 GNurMQO1UI.exe 5 2->8         started        process3 signatures4 49 Bypasses PowerShell execution policy 8->49 11 powershell.exe 44 8->11         started        process5 file6 35 C:\Windows\Branding\mediasvc.png, PE32+ 11->35 dropped 37 C:\Windows\Branding\mediasrv.png, PE32+ 11->37 dropped 39 C:\Users\user\AppData\...\airblroo.cmdline, UTF-8 11->39 dropped 51 Uses cmd line tools excessively to alter registry or file data 11->51 53 Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes) 11->53 55 Powershell drops PE file 11->55 15 reg.exe 11->15         started        18 csc.exe 11->18         started        21 powershell.exe 11->21         started        23 5 other processes 11->23 signatures7 process8 file9 57 Creates a Windows Service pointing to an executable in C:\Windows 15->57 33 C:\Users\user\AppData\Local\...\airblroo.dll, PE32 18->33 dropped 25 cvtres.exe 18->25         started        27 conhost.exe 21->27         started        29 conhost.exe 23->29         started        31 conhost.exe 23->31         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8962a3b3d7ed877d9642f72ad224101c528f965de1facb3ee87276cb144dfaf6/
Threat name:
Win64.Trojan.WinGoGoCLR
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 12:06:30 UTC
File Type:
PE+ (Exe)
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rfrkhm6x5wdx3fsc64vnejaqdrji7fs54h5mwpxioj3mwfcn7l3a._file
Verdict:
malicious
Similar samples:
4411d8a69230284cb6238a2e8cf29878afbbef90935bb94d1a6f8d59af30c6cc
ServHelper
5090fa74f83368086c1d197dcd28e51f8b36cd5d2c18e9a964d925a445ea0066
ServHelper
6890d24b841f053f3fa975836a3f37e25370942c935acc3ffa9965ae55137e25
ServHelper
71599788e1da3359b99ada8c3b84b96a9741c1f68550c09b0345d979cdc4b8a6
ServHelper
78f5967d8bd5d31343632e8558b9315d9d44d009c923b9c41d417943906f2849
ServHelper
9d9d5a0deb68bdd7c04d6507e3823711d08d9d8482de8e0a4a5b8086763f84ff
ServHelper
a27fa7724da938df040a3e535f2be9cec4d6d93bd4f2e5ec2ba79560f84cb69c
ServHelper
a6e43031567484437341b50ea0c165ad416ffa629e2951a0e82844dcfb27e408
ServHelper
c302411319308e836e2eac6893ba39b513226d19d874ce9ff7fbbbd07316aba3
ServHelper
eed912423954b56dc4ea01f9d3fb1c46ea175be378889fd886e37c09954cfaba
ServHelper
+ 74 additional samples on MalwareBazaar
Result
Malware family:
servhelper
Create hunting rule
Score:
  10/10
Tags:
family:servhelper backdoor discovery exploit persistence trojan upx
Link:
https://tria.ge/reports/210408-1ddzythkz6/
Behaviour
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Modifies registry key
Runs net.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Loads dropped DLL
Modifies file permissions
Blocklisted process makes network request
Modifies RDP port number used by Windows
Possible privilege escalation attempt
Sets DLL path for service in the registry
UPX packed file
Grants admin privileges
ServHelper
Malware Config
Dropper Extraction:
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Unpacked files
SH256 hash:
8962a3b3d7ed877d9642f72ad224101c528f965de1facb3ee87276cb144dfaf6
MD5 hash:
67716e7c7b42b3c29d7ccddaa4cf85f4
SHA1 hash:
83441ce2d1782efe6789242a4f898517d904175a
Link:
https://www.unpac.me/results/e1aa9cfd-a98e-4f9e-a5db-077f5b6eb94e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
VirLock
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8962a3b3d7ed877d9642f72ad224101c528f965de1facb3ee87276cb144dfaf6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_TOOL_GoCLR
Create hunting rule
Author:ditekSHen
Description:Detects binaries utilizing Go-CLR for hosting the CLR in a Go process and using it to execute a DLL from disk or an assembly from memory
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:susp_winsvc_upx
Create hunting rule
Author:SBousseaden
Description:broad hunt for any PE exporting ServiceMain API and upx packed
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings
Rule name:win_servhelper_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ServHelper

Executable exe 8962a3b3d7ed877d9642f72ad224101c528f965de1facb3ee87276cb144dfaf6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1104408/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133281/

Comments