ServHelper is written in Delphi and according to ProofPoint best classified as a backdoor. ProofPoint noticed two distinct variant - 'tunnel' and 'downloader' (citation): 'The 'tunnel' variant has more features and focuses on setting up reverse SSH tunnels to allow the threat actor to access the infected host via Remote Desktop Protocol (RDP). Once ServHelper establishes remote desktop access, the malware contains functionality for the threat actor to 'hijack' legitimate user accounts or their web browser profiles and use them as they see fit. The 'downloader' variant is stripped of the tunneling and hijacking functionality and is used as a basic downloader.'
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|---|
| 185.163.45.248:443 | 2021-09-29 |
| 194.180.174.56:443 | 2021-08-14 |
| 194.180.174.20:443 | 2021-08-11 |
| 185.163.47.254:443 | 2021-07-19 |
| 185.163.45.90:443 | 2021-07-16 |
| 185.163.47.171:443 | 2021-07-13 |
| 185.163.45.87:443 | 2021-06-28 |
| 103.113.159.7:443 | 2021-05-23 |
| 140.82.57.172:443 | 2021-04-03 |
| 45.77.122.108:443 | 2021-03-31 |
| Domain | Timestamp |
|---|---|
| sbbsats5d5asdv3.xyz | 2021-12-12 |
| z7gzv6sw6ui9.xyz | 2021-12-12 |
| nacuasujciiwi3.xyz | 2021-12-06 |
| hsuahiysautcr.xyz | 2021-11-26 |
| kasisausnasaysar.xyz | 2021-12-18 |
| asdyyauscuauusc.xyz | 2021-12-06 |
| osdnvnauurt.xyz | 2021-10-31 |
| aosdnvnauurt.xyz | 2021-10-27 |
| zdov9v88e83jfa.xyz | 2021-10-31 |
| saudjyyvv663.xyz | 2021-09-29 |
| URL | Timestamp |
|---|
2022-09-06 by PRODAFT from PRODAFT
2022-09-05 by PRODAFT from PRODAFT
2021-09-03 by Mohamad Mokbel from Trend Micro
2021-08-12 by Vanja Svajcer from Cisco Talos
2021-07-06 by Jason Reaves from Medium walmartglobaltech
2020-10-03 by Avira Protection Labs from Avira
2020-08-20 by CERT-FR from CERT-FR
2020-07-09 by G DATA Security Lab from Gdata
2020-06-22 by CERT-FR from CERT-FR
2020-05-22 by PT ESC Threat Intelligence from Positive Technologies
2020-05-21 by Intel 471 from Intel 471
2020-02-13 by Qi Anxin Threat Intelligence Center from Qianxin
2020-01-09 by SonicWall from SonicWall
2020 by SecureWorks from Secureworks
2019-12-20 by James Quinn from Binary Defense
2019-12-17 by Adrián Ruiz from Blueliv
2019-08-29 by ThreatRecon Team from ThreatRecon
2019-08-27 by Hara Hiroaki from Trend Micro
2019-04-25 by Cybereason Nocturnus from Cybereason
2019-04-02 by Shaul Vilkomir-Preisman from DeepInstinct
2019-01-24 by 事件追踪 from 奇安信威胁情报中心
2019-01-09 by Dennis Schwarz from Proofpoint
2019 by CyberInt from CyberInt
Tool: ServHelper
Names: ServHelper
Description: ServHelper is written in Delphi and according to ProofPoint best classified as a backdoor. ProofPoint noticed two distinct variant - 'tunnel' and 'downloader' (citation): 'The 'tunnel' variant has more features and focuses on setting up reverse SSH tunnels to allow the threat actor to access the infected host via Remote Desktop Protocol (RDP). Once ServHelper establishes remote desktop access, the malware contains functionality for the threat actor to 'hijack' legitimate user accounts or their web browser profiles and use them as they see fit. The 'downloader' variant is stripped of the tunneling and hijacking functionality and is used as a basic downloader.'
Category: Malware
Type: Backdoor, Credential stealer, Downloader
Information: https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
Information: https://www.deepinstinct.com/2019/04/02/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload/
Information: https://ti.360.net/blog/articles/excel-4.0-macro-utilized-by-ta505-to-target-financial-institutions-recently-en/
Mitre-attack: https://attack.mitre.org/software/S0382/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.servhelper
Last-card-change: 2020-05-14
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1059.001 COMMAND AND SCRIPTING INTERPRETER : POWERSHELL servhelper has the ability to execute a powershell script to get information from the infected host. T1059.003 COMMAND AND SCRIPTING INTERPRETER : WINDOWS COMMAND SHELL servhelper can execute shell commands against cmd. T1053.005 SCHEDULED TASK/JOB : SCHEDULED TASK servhelper contains modules that will use schtasks to carry out malicious operations. | T1098 ACCOUNT MANIPULATION servhelper has added a user named "supportaccount" to the remote desktop users and administrators groups. T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER servhelper may attempt to establish persistence via the hkcu\software\microsoft\windows\currentversion\run\ run key. T1053.005 SCHEDULED TASK/JOB : SCHEDULED TASK servhelper contains modules that will use schtasks to carry out malicious operations. | T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER servhelper may attempt to establish persistence via the hkcu\software\microsoft\windows\currentversion\run\ run key. T1053.005 SCHEDULED TASK/JOB : SCHEDULED TASK servhelper contains modules that will use schtasks to carry out malicious operations. | T1070.004 INDICATOR REMOVAL : FILE DELETION servhelper has a module to delete itself from the infected machine. T1218.011 SYSTEM BINARY PROXY EXECUTION : RUNDLL32 servhelper contains a module for downloading and executing dlls that leverages rundll32.exe. | T1082 SYSTEM INFORMATION DISCOVERY servhelper will attempt to enumerate windows version and system architecture. | T1021.001 REMOTE SERVICES : REMOTE DESKTOP PROTOCOL servhelper has commands for adding a remote desktop user and sending rdp traffic to the attacker through a reverse ssh tunnel. | T1573.002 ENCRYPTED CHANNEL : ASYMMETRIC CRYPTOGRAPHY servhelper may set up a reverse ssh tunnel to give the attacker access to services running on the victim, such as rdp. |