ServHelper
ServHelper is a backdoor first observed in late 2018. The backdoor is written in Delphi and is typically delivered as a DLL file.[1]
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
ServHelper uses HTTP for C2.[1] |
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
ServHelper may attempt to establish persistence via the |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
ServHelper can execute shell commands against cmd.[1][2] |
.001 | Command and Scripting Interpreter: PowerShell |
ServHelper has the ability to execute a PowerShell script to get information from the infected host.[3] |
||
Enterprise | T1136 | .001 | Create Account: Local Account |
ServHelper has created a new user and added it to the "Remote Desktop Users" and "Administrators" groups.[1] |
Enterprise | T1573 | .002 | Encrypted Channel: Asymmetric Cryptography |
ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.[1] |
Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion |
ServHelper has a module to delete itself from the infected machine.[1][2] |
Enterprise | T1105 | Ingress Tool Transfer |
ServHelper may download additional files to execute.[1][2] |
|
Enterprise | T1021 | .001 | Remote Services: Remote Desktop Protocol |
ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.[1] |
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
ServHelper contains modules that will use schtasks to carry out malicious operations.[1] |
Enterprise | T1218 | .011 | Signed Binary Proxy Execution: Rundll32 |
ServHelper contains a module for downloading and executing DLLs that leverages |
Enterprise | T1082 | System Information Discovery |
ServHelper will attempt to enumerate Windows version and system architecture.[1] |
|
Enterprise | T1033 | System Owner/User Discovery |
ServHelper will attempt to enumerate the username of the victim.[1] |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0092 | TA505 |
References
- Hiroaki, H. and Lu, L. (2019, June 12). Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns. Retrieved May 29, 2020.
- Salem, E. (2019, April 25). Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware. Retrieved May 28, 2019.