Skip to content
MalwareWiki

Malware

GRILLMARK

aka Hellsing Backdoor

This is a proxy-aware HTTP backdoor that is implemented as a service and uses the compromised system's proxy settings to access the internet.

GRILLMARK, also known as Hellsing Backdoor, is a Windows malware family operated by Hellsing and Leviathan.

Background

GRILLMARK is a proxy-aware HTTP backdoor that runs as a service and reaches the internet through the victim system's configured proxy settings. Its C&C traffic is base64 encoded, while files uploaded to the server are compressed using aPLib.

Source: Malpedia (Fraunhofer FKIE).