Extracted

• • Target

    b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15

  • Size

    6.1MB

  • MD5

    ea2e527c2a141b9ea8052b506ca4fbd9

  • SHA1

    ad5d7788f6c447759422648f55a2d12e4a4a19ab

  • SHA256

    b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15

  • SHA512

    38c489b3016f5a804130ce43b0da878d98e4504045e3e85459e83487992d941d03d93f7ad4bbdc8b7ee16aaefc0c205a582ab0eb2a08767cac9b31a160f527c3

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2