MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfdb155368f72aed83e715260f1dd63922a25ce4e6d558941f94cb4a06357994. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ServHelper


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfdb155368f72aed83e715260f1dd63922a25ce4e6d558941f94cb4a06357994
SHA3-384 hash: 57914ed07436a29840d09636be0c9cb7aecea492f7dff013a0ddc5c5993135c296c57e5d3e087184f6a44ea3d009dcb5
SHA1 hash: 133d86495e1b248253280bb10a24da1045a75594
MD5 hash: 96d4ecbc8b4e168039901376fc5a8b5a
humanhash: artist-oxygen-sink-steak
File name:96d4ecbc8b4e168039901376fc5a8b5a.exe
Download: download sample
Signature ServHelper
Create hunting rule
File size:3'348'480 bytes
First seen:2021-07-16 07:42:55 UTC
Last seen:2021-07-16 08:41:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:wYtM/Sqkj9enL2d/pZLkD4HyPh9XkwDKVXQ/Vx5AA/+a5kj/Qm78aC8V/zI:S/u4nL+/5Hyp9kEUQ/T5A2burQm7rS
Threatray 176 similar samples on MalwareBazaar
TLSH T181F5238C772832CEC917D9728ED82C68EAB13463834BA253D4930A9D995DD83DF561F2
Reporter abuse_ch
Tags:exe ServHelper

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'340
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
96d4ecbc8b4e168039901376fc5a8b5a.exe
Verdict:
No threats detected
Analysis date:
2021-07-16 07:46:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f1b30fee-feab-47d3-a8d9-33bd7d3f7823

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172119/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.14176.32263.32467.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4d1dcc17-4d99-4a5f-9a41-1a8cba1b8ce4
Result
Threat name:
SERVHELPER
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817324
Signature
Adds a new user with administrator rights
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Contains functionality to start a terminal service
Creates a Windows Service pointing to an executable in C:\Windows
Detected SERVHELPER
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Hurricane Panda Activity
Sigma detected: Suspicious Csc.exe Source File Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Uses cmd line tools excessively to alter registry or file data
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 449735 Sample: hnLuDve5mx.exe Startdate: 16/07/2021 Architecture: WINDOWS Score: 100 81 Multi AV Scanner detection for domain / URL 2->81 83 Antivirus detection for URL or domain 2->83 85 Antivirus detection for dropped file 2->85 87 7 other signatures 2->87 11 hnLuDve5mx.exe 3 2->11         started        15 cmd.exe 2->15         started        17 cmd.exe 2->17         started        19 rdpdr.sys 2->19         started        process3 file4 75 C:\Users\user\AppData\...\hnLuDve5mx.exe.log, ASCII 11->75 dropped 103 Writes to foreign memory regions 11->103 105 Allocates memory in foreign processes 11->105 107 Modifies the context of a thread in another process (thread injection) 11->107 109 Injects a PE file into a foreign processes 11->109 21 vbc.exe 5 11->21         started        24 net.exe 15->24         started        26 conhost.exe 15->26         started        28 conhost.exe 17->28         started        30 net.exe 17->30         started        signatures5 process6 signatures7 97 Bypasses PowerShell execution policy 21->97 32 powershell.exe 65 21->32         started        37 net1.exe 24->37         started        process8 dnsIp9 79 45.61.136.223, 49727, 80 AS40676US United States 32->79 69 C:\Windows\Branding\mediasvc.png, PE32+ 32->69 dropped 71 C:\Windows\Branding\mediasrv.png, PE32+ 32->71 dropped 73 C:\Users\user\AppData\...\qzmebcw5.cmdline, UTF-8 32->73 dropped 89 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 32->89 91 Uses cmd line tools excessively to alter registry or file data 32->91 93 Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes) 32->93 95 2 other signatures 32->95 39 powershell.exe 32->39         started        42 reg.exe 32->42         started        44 cmd.exe 32->44         started        46 8 other processes 32->46 file10 signatures11 process12 file13 99 Detected SERVHELPER 39->99 49 conhost.exe 39->49         started        101 Creates a Windows Service pointing to an executable in C:\Windows 42->101 51 cmd.exe 44->51         started        77 C:\Users\user\AppData\Local\...\qzmebcw5.dll, PE32 46->77 dropped 53 cmd.exe 46->53         started        55 cvtres.exe 46->55         started        57 conhost.exe 46->57         started        59 2 other processes 46->59 signatures14 process15 process16 61 net.exe 51->61         started        63 net.exe 53->63         started        process17 65 net1.exe 61->65         started        67 net1.exe 63->67         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfdb155368f72aed83e715260f1dd63922a25ce4e6d558941f94cb4a06357994/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-07-13 03:59:52 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7nrku3i64vo3a7hcuta6howherkexhe43kvrfa7stfuubrvpgka._file
Verdict:
malicious
Similar samples:
1555f744c779e3ce93f92b454ad2092e136622c39c21eca20125dd79cdf8fb94
ServHelper
15e71d5e4b29bbf6f1e97bb6ff2cfdb199fb040746d57443163a5c8fecd745aa
ServHelper
2142824c415eb4f05facc471942840e5065aa41b322f36dac198d30d00e8b6fc
ServHelper
4d7bb45f219aaebc5c2745b60879b954a56b58a3f16c5e5c3252143c9b7a3a47
ServHelper
7dc721c6b633d783562f73d629267da7a16a77b4dae9ab280250c116bdfec591
ServHelper
d9ec3c5cf92b5b3aa1d59949cf1eafb9c695d35ce9872215ba8b189d40c66823
ServHelper
eb02c967fb3feaf5504a78de8a7e0513c2c4e52ddf2243bfbcb10e83954baaad
ServHelper
fe40b63a00a7d737baa87f493751a1b92ac782baaef2304b0ae65c5a1cbec58d
ServHelper
fe65170a6f6cd5ba0df997262bca40350b650067db206bc83bfaf80da94bba9e
ServHelper
+ 166 additional samples on MalwareBazaar
Result
Malware family:
servhelper
Create hunting rule
Score:
  10/10
Tags:
family:servhelper backdoor discovery exploit persistence trojan upx
Link:
https://tria.ge/reports/210716-q1qvgp9j1s/
Behaviour
Modifies data under HKEY_USERS
Modifies registry key
Runs net.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Modifies file permissions
Uses the VBS compiler for execution
Blocklisted process makes network request
Modifies RDP port number used by Windows
Possible privilege escalation attempt
Sets DLL path for service in the registry
UPX packed file
Core1 .NET packer
Grants admin privileges
ServHelper
Malware Config
Dropper Extraction:
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Unpacked files
SH256 hash:
cfdb155368f72aed83e715260f1dd63922a25ce4e6d558941f94cb4a06357994
MD5 hash:
96d4ecbc8b4e168039901376fc5a8b5a
SHA1 hash:
133d86495e1b248253280bb10a24da1045a75594
Link:
https://www.unpac.me/results/dfb43c4a-e457-4d59-97a9-b41c56688b40/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cfdb155368f72aed83e715260f1dd63922a25ce4e6d558941f94cb4a06357994

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/172119/

Comments