MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c75628570312cdb6e8607ad1e46aeb3ae3031d4f450262ccb163245a8c467e3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ServHelper


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c75628570312cdb6e8607ad1e46aeb3ae3031d4f450262ccb163245a8c467e3a
SHA3-384 hash: 5f0598504ab332c99469a061c9df762d5352aba01c53fad78f887d75493afaf3717c591ec2a4c9de965db0783c09a22f
SHA1 hash: 71dcc3284f6b9bdf27ce0bb3fb136b5dfee14169
MD5 hash: 3a34e91875163547cb960ee35bc3090a
humanhash: mars-london-hawaii-carpet
File name:c75628570312cdb6e8607ad1e46aeb3ae3031d4f450262ccb163245a8c467e3a
Download: download sample
Signature ServHelper
Create hunting rule
File size:3'558'912 bytes
First seen:2020-11-13 15:40:08 UTC
Last seen:2024-07-24 21:21:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76a1972a031896a17e29d4c55d0b230 (8 x ServHelper, 5 x Tofsee, 3 x CoinMiner)
ssdeep 98304:8/nKRYPy3pi9W5sXgwpbiluMEeIuQl4v:8/nKRYKZi9WqXXbiJtil4
Threatray 6 similar samples on MalwareBazaar
TLSH 4EF533E0B683E7F2E9174435856DC865243C4D0A2778D58BA7853A4F3E607F3C192BAE
Reporter seifreed
Tags:ServHelper

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'040
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Glupteba-9781402-0
Create hunting rule

Win.Packed.Generickdz-9784859-0
Create hunting rule

Win.Packed.Generickdz-9785340-0
Create hunting rule

Win.Packed.Generickdz-9785522-0
Create hunting rule

Win.Packed.Emotet-9790742-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Deleting a recently created file
Using the Windows Management Instrumentation requests
Creating a file in the Windows subdirectories
Launching the process to interact with network services
Running batch commands
Launching a service
Loading a system driver
Enabling autorun for a service
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c75628570312cdb6e8607ad1e46aeb3ae3031d4f450262ccb163245a8c467e3a/
Threat name:
Win32.Trojan.MintDreidel
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:44:05 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y5lcqvydclg3n2dapli6i2xlhlrqghkpiubgftfrmmsfvdcgpy5a._file
Verdict:
unknown
Similar samples:
1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2
ServHelper
261603776412fc9028feb04ba71a42c5d6bd99c0e4fbb4610d19e6d649dba700
ServHelper
2c2a59fb155590024a3b791f460a33525a44b87e1521a409885c5ed0c1b80f31
ServHelper
3bb3d4d11e9e4c2f50e264e3bf7966d15260cf02403d2a9288709c97e355beab
ServHelper
853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818
ServHelper
b7571fe26056b7baa31b0935b6be42c8fa1d55a742c26d58b1c2e017394adc14
ServHelper
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery exploit persistence upx
Link:
https://tria.ge/reports/201113-4jsvnj83be/
Behaviour
Modifies data under HKEY_USERS
Modifies registry key
Runs net.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Drops file in Program Files directory
Drops file in System32 directory
Modifies service
Deletes itself
Loads dropped DLL
Modifies file permissions
Blacklisted process makes network request
Modifies RDP port number used by Windows
Possible privilege escalation attempt
Sets DLL path for service in the registry
UPX packed file
Grants admin privileges
Malware Config
Dropper Extraction:
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Unpacked files
SH256 hash:
3214069bba6f4b838fd713013c1f6108ca60fa7db11c4274a24a48ef49b5494c
MD5 hash:
4e0a8cf162cd7cd6471e90d85b548ee6
SHA1 hash:
41d4c5b0158903715846f16c8e81ce97625961b1
Link:
https://www.unpac.me/results/c53450d2-0f6f-461a-8b14-4355fb52fdff/
SH256 hash:
c75628570312cdb6e8607ad1e46aeb3ae3031d4f450262ccb163245a8c467e3a
MD5 hash:
3a34e91875163547cb960ee35bc3090a
SHA1 hash:
71dcc3284f6b9bdf27ce0bb3fb136b5dfee14169
Link:
https://www.unpac.me/results/c53450d2-0f6f-461a-8b14-4355fb52fdff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Glupteba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c75628570312cdb6e8607ad1e46aeb3ae3031d4f450262ccb163245a8c467e3a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:susp_winsvc_upx
Create hunting rule
Author:SBousseaden
Description:broad hunt for any PE exporting ServiceMain API and upx packed
Rule name:win_servhelper_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments