Extracted

• • Target

    b23f257eddfbe8de4150e590a9328293.exe

  • Size

    6.0MB

  • MD5

    b23f257eddfbe8de4150e590a9328293

  • SHA1

    724fc4f1a2c27ba4987a58d6169677b740788d9a

  • SHA256

    e93ad362b1d92779ef40523def774c76cb59ee9bba560f88679063404a5999e9

  • SHA512

    4593a7722817c369353b05a6fd02f4e3a743de70a73ddad48e340c5e8cb9bcc3ee6d9f48cb04f4f12c99594877367b9b4dfbc90a06c97cae051453aac72acba4

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2