Extracted

• • Target

    40367f496f45ba45b8545f90065b6940.exe

  • Size

    6.1MB

  • MD5

    40367f496f45ba45b8545f90065b6940

  • SHA1

    1d7bd76d538e1c1859999b807c071d6f1b930597

  • SHA256

    9d1ca3a1dad26b6c0195ac41fe5fa6e5e03706496944383ca9156fa99e57dc8a

  • SHA512

    aa8a3326b497dd56f2f383bc77a7a5445260303e156632296267831e857afbb69982ed53fb756564cf2557bafb9ca34dd2e2167fdf7f28a429ff77aa2957580b

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2