#servhelper search results

We found a new sample of #ServHelper #Malware and the contacted domain. md5: 9a31f70f5d05e033d1644f97ef1471ae IOC: xgdhh33jfas[.]xyz Check it out: threatbook.io/domain/xgdhh33… #ThreatHunting #ThreatIntelligence #infosec #cybersecurity #cybercrime #SOC

We found a new sample of #ServHelper #Malware and the contacted domain. md5: 9a31f70f5d05e033d1644f97ef1471ae IOC: xgdhh33jfas[.]xyz Check it out: threatbook.io/domain/xgdhh33… #ThreatHunting #ThreatIntelligence #infosec #cybersecurity #cybercrime #SOC

This week, @PRODAFT has issued a report 📋 detailing the #ServHelper backdoor and #TeslaGun panel used by the threat actor #TA505. (via @marqufabi) 🧵 1/6

In this week’s SnapShot, we dive into fresh intelligence about #EvilCorp and their use of #TeslaGun and #ServHelper. Stay ahead of this threat with SnapAttack: youtu.be/OWxKQ3UBbjc

Experts discovered #TeslaGun Panel used by #TA505 to manage its #ServHelper #Backdoor securityaffairs.co/wordpress/1353… #securityaffairs #hacking #malware

TA505 #Hackers Using #TeslaGun Panel to Manage #ServHelper #Backdoor #Attacks vapt.me/TeslaGun

TA505 Hackers Using #TeslaGun Panel to Manage #ServHelper #Backdoor Attacks thehackernews.com/2022/09/ta505-…

Researchers uncover "#TeslaGun," a previously undocumented software control panel used by the financially motivated cybercrime group #TA505 to manage its "#ServHelper" backdoor #malware attacks. thehackernews.com/2022/09/ta505-… #infosec #cybersecurity #hacking

Group #TA505 financially motivated using #TeslaGun to manage #ServHelper Backdoor attacks, the group frequently changes its malware attack strategies in response to global cybrecrime trends. #2022 #Infosec #BT ed.gr/d9nxv

Experts discovered #TeslaGun Panel used by #TA505 to manage its #ServHelper #Backdoor securityaffairs.co/wordpress/1353… #securityaffairs #hacking #malware

@PRODAFT Experts discovered #TeslaGun Panel used by #TA505 to manage its #ServHelper #Backdoor securityaffairs.co/wordpress/1353… #securityaffairs #hacking #malware

Updated graph of domains possibly related to ServHelper malware includes 3 new hosts out of 420 we have #malware #ServHelper extending feed of #ThreatFox tinyurl.com/ydyhbrv5

#servhelper dropping #remcos at: http://165.22.201[.]28/lnks/r.exe c2's: https://www.pinotnoir[.]xyz/portal/s.php 151.80.8.32 hashes 63e3771a6c95e7c14e3ac9e9e733f7ef and ad55c929e767f4b65506f2a9e376192f on @mal_share

Publishing a #ja3 (github.com/salesforce/ja3) csv of malicious TLS fingerprints of junk that crosses my path: github.com/silence-is-bes… Only a couple for now (new #servhelper though). Thoughts, ideas, and improvements welcome.

One of the cexplorer.exe is trojaned with a UPX compressed #smokeloader bin, which in turn drops #azorult which in turn drops #servhelper. c2's: http://gabrielreed[.]pw/ <- smoke http://5.255.94[.]90/index.php <-azo https://rgdsghhdfa[.]pw/x/s.php <- servhelper

#TA505 #APT analysis- medium.com/@reegun/ta505-… While investigating final payload (#ServHelper) of TA505, Found unregistered/unused domains,they are still available to register,so we may expect next wave with these dsfk3322442fr44446g[.]icu  - Used/not registered gdskjkkkss[.]pw

The #ThreatHunting team scours all the dark corners and hidden alleys of the web to find emerging threats, deconstruct, and defeat them, protecting our clients from all manner of #cyberthreats. Check out this recent finding on #servhelper bit.ly/2ZjywK3

We found a new sample of #ServHelper #Malware and the contacted domain. md5: 9a31f70f5d05e033d1644f97ef1471ae IOC: xgdhh33jfas[.]xyz Check it out: threatbook.io/domain/xgdhh33… #ThreatHunting #ThreatIntelligence #infosec #cybersecurity #cybercrime #SOC

Mentioned Samples bazaar.abuse.ch/browse/tag/Fil… IoC in addiction hXXps://asuvuyv7ew3hd.xyz/segka/b.php #ServHelper cc @verovaleros

The #ServHelper RAT is really *serving* up some spoiled stuff to targets. We've spotted #GroupTA505 using this and other tools to steal credit card data and exfiltrate data cs.co/6019ymlLH

Based on my analysis the sample is not #Emotet... it's #ServHelper. C2 afsafasdarm,icu POST /jquery/jquery.php

Collection of know #Signed "OOO Diamartis" Samples including #RaccoonStealer / #servhelper / ✳️bazaar.abuse.ch/browse/tag/OOO… ❇️bazaar.abuse.ch/sample/7dc721c… ✳️bazaar.abuse.ch/sample/c54228f… H/T @malwrhunterteam 🔽hXXp://107.167.89. 175/dl/VNPhone.exe🔽

New Year wishes from the #TA505 group (with love for russian researchers): MD5: a7cea801e0382676ff8e800187607276 hxxp://jopanovigod.xyz/f8h7ghd8gd8/index.php jopanovigod -> jopa novi god -> ass new year #ServHelper

🚨 Ad Hoc domain spreads @Filmora_Editor installation package, but is binder with malware! The #Malware (#ServHelper) developed in Go and possibly from the #TA505 group! ℹ️IoC: wondershare-filmora[.]com pgf5ga4g4b[.]cn ➡️ More Info and IoC: d3lab.net/falsa-sito-fil… #mwitaly

2019-04-18: #ServHelper #NSIS Loader Chain | #Signed -> /jquery.php 🙂 C2: houusha33[.]icu/jquery/jquery.php h/t @malwrhunterteam ⛓️Example Exec Chain: { %TEMP%\nsy28C2.tmp\ns28C3.tmp" "cmd.exe" /c rundll32 %TEMP%\repotaj.dll, feast } MD5: 329d3e86fb9fca6a656742c6aa8ee13e

2019-07-20: 👁‍🗨#ServHelper Loader #Malware | #Signed 🔏[HAB CLUB LTD] #Thawte C2: http://towerprod3[.]com/docs/saz.php | PowerShell Profiling h/t @malwrhunterteam MD5: eb7cdf5a96ae5f5a596a6ed423f786a7

#ThreatProtection #ServHelper #RAT distributed via latest #TA505 campaigns, read more: broadcom.com/support/securi…

2019-06-13: #ServHelper #NSIS #Loader Chain | #Signed Digital Cert🔏 -> [SLOW POKE LTD] #Thawte C2: trailerbla[.]icu/js/s.php { key=test | sysid=apr22 } h/t @malwrhunterteam ⛓️Example Exec Chain: { NSIS - rundll32 %TEMP%\lopotr.dll,tase } MD5: 2cd383021380d0eb69faa7a621ae67e6

A few fresh and rebuilt #ServHelper samples related to #TA505 group. The Vigenere encryption for strings remains the same.

The latest #malware from TA505 has been seen targeting banks, retailers and restaurants with two #backdoor variants. kas.pr/p1h5 #ServHelper #security #news

The #ThreatHunting team scours all the dark corners and hidden alleys of the web to find emerging threats, deconstruct, and defeat them, protecting our clients from all manner of #cyberthreats. Check out this recent finding on #servhelper bit.ly/2ZjywK3

Two new malware variants introduced by threat actor #TA505 are now in our extensive Threat DB. The actor seemingly delivers the #Servhelper backdoor malware, sets up a reverse SSH channel or downloads and executes #FlawedGrace RAT for remote administration ow.ly/mapn50kdre8