wkhpd.exe

wkhpd.exe is a malicious software (malware) that was created and used by Advanced Persistent Threat (APT) actors. This malware is a variant of Metasploit's Meterpreter, which was specifically designed to exploit the ServiceDesk system. The creation and use of this malware were first identified on February 3, 2023, at 15:12:23. It was found to be communicating with a known malicious IP address, 108.62.118[.]160, indicating its potential use in coordinating cyber-attacks or illicit activities. The malware operates by connecting and receiving unencrypted payloads from its command and control (C2) servers. This allows the APT actors to remotely control infected systems, potentially leading to unauthorized access, data theft, and disruption of operations. The wkhpd.exe malware is often distributed through suspicious downloads, emails, or websites, making it a significant threat to unsuspecting users and vulnerable systems. In addition to wkhpd.exe, another file named bitmap.exe was also identified as a variant of Metasploit's Meterpreter. Both these files are designed to perform similar functions, suggesting a coordinated attack strategy by the same group of APT actors. As such, it is crucial for organizations to enhance their cybersecurity measures, including regular system checks and updates, to mitigate the risk posed by these malicious programs.