Extracted

• • Target

    7a383f57f7d2190d9af3e57d67cfb004

  • Size

    6.9MB

  • MD5

    7a383f57f7d2190d9af3e57d67cfb004

  • SHA1

    2e783c279542ea1708854413a0cd725184f8fa78

  • SHA256

    f18e085889d9d7324c57ecb800563ba2e808c0ef8ad52b7b1f1f3afa169bf836

  • SHA512

    0f2509170c215efd58a09b4a00d593f087773da93f1877aab9b9f24474b06ad62494fa730fc435829a0365d7bd3d7440818a99e1b4c866882a0ed1cdc3eec9cb

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2