New ServHelper Backdoor and FlawedGrace RAT Pushed by Necurs Botnet

guest · Jan 10, 2019

New ServHelper Backdoor and FlawedGrace RAT Pushed by Necurs Botnet
January 10, 2019
https://www.bleepingcomputer.com/ne...-and-flawedgrace-rat-pushed-by-necurs-botnet/

Malware researchers discovered two new malware families distributed through phishing campaigns last year from the Necurs botnet: ServHelper backdoor with two variants and FlawedGrace remote access trojan (RAT).
Necurs campaigns deliver ServHelper
A first salvo of malicious messages was shot on November 9, 2018. It was a small campaign with several thousand emails delivering Word and Publisher documents laced with hostile macros.

The purpose of the macro was to download and execute a variant of ServHelper that set up reverse SSH tunnels that enabled access to the infected host through the Remote Desktop Protocol (RDP) port 3389.
The other ServHelper variant does not include the tunneling and hijacking capabilities and functions only as a downloader for the FlawedGrace RAT.
FlawedGrace is a tough nut to crack
They also point out that FlawedGrace is a full-featured RAT written in C++ and that it is a very large program that "extensive use of object-oriented and multithreaded programming techniques." As a consequence, getting familiar with its internal structure takes a lot of time and is far from a simple task.
Click to expand...

Proofpoint: ServHelper and FlawedGrace - New malware introduced by TA505

Log in or Sign up

New ServHelper Backdoor and FlawedGrace RAT Pushed by Necurs Botnet

guest Guest

Log in or Sign up

New ServHelper Backdoor and FlawedGrace RAT Pushed by Necurs Botnet

guest Guest

Useful Searches