1. Home
  2. Software
  3. ServHelper

ServHelper

ServHelper is a backdoor first observed in late 2018. The backdoor is written in Delphi and is typically delivered as a DLL file.[1]

ID: S0382
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 29 May 2019
Last Modified: 29 May 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

ServHelper uses HTTP for C2.[1]
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.[2]
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

ServHelper has the ability to execute a PowerShell script to get information from the infected host.[3]
.003 Command and Scripting Interpreter: Windows Command Shell

ServHelper can execute shell commands against cmd.[1][2]
Enterprise T1136 .001 Create Account: Local Account

ServHelper has created a new user and added it to the "Remote Desktop Users" and "Administrators" groups.[1]
Enterprise T1573 .002 Encrypted Channel: Asymmetric Cryptography

ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.[1]
Enterprise T1070 .004 Indicator Removal on Host: File Deletion

ServHelper has a module to delete itself from the infected machine.[1][2]
Enterprise T1105 Ingress Tool Transfer

ServHelper may download additional files to execute.[1][2]
Enterprise T1021 .001 Remote Services: Remote Desktop Protocol

ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.[1]
Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

ServHelper contains modules that will use schtasks to carry out malicious operations.[1]
Enterprise T1218 .011 System Binary Proxy Execution: Rundll32

ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.[2]
Enterprise T1082 System Information Discovery

ServHelper will attempt to enumerate Windows version and system architecture.[1]
Enterprise T1033 System Owner/User Discovery

ServHelper will attempt to enumerate the username of the victim.[1]

Groups That Use This Software

ID Name References
G0092 TA505

[1][4][2][3]

References

  1. Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.
  2. Vilkomir-Preisman, S. (2019, April 2). New ServHelper Variant Employs Excel 4.0 Macro to Drop Signed Payload. Retrieved May 28, 2019.
  1. Hiroaki, H. and Lu, L. (2019, June 12). Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns. Retrieved May 29, 2020.
  2. Salem, E. (2019, April 25). Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware. Retrieved May 28, 2019.