Extracted

• • Target

    file23.exe

  • Size

    4.7MB

  • MD5

    4c9bb1adf101943c077c224a224ed490

  • SHA1

    82defd568a645681adbff05fea64cf4a0a5659e0

  • SHA256

    44815a42eb3317c7e567f8e20388bd9e28cf71096f45f4ee6094f26888dcfb0c

  • SHA512

    ab4e228c732c64630975332a64c52668266a64da6b6f4a0f68d558d7b22964d057ae1c7c46d04339784effb0a7b26dbd3e92a728639dd4a0fdb9837002dc64dc

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2