H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ServHelper](https://attack.mitre.org/software/S0382) is a backdoor first observed in late 2018. The backdoor is written in Delphi and is typically delivered as a DLL file.(Citation: Proofpoint TA505 Jan 2019)

Labels

malware

16 recorded

Relationships

uses

to Additional Local or Domain Groups

Technique

uses

to Asymmetric Cryptography

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Masquerade Account Name

Technique

uses

to PowerShell

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Rundll32

Technique

uses

to Scheduled Task

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

from TA505

Group

2 external

References

mitre-attack

S0382

open

Proofpoint TA505 Jan 2019

https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505

open