Extracted

• • Target

    b8c76065042d1557af857a48a5ac0f3e.exe

  • Size

    5.7MB

  • MD5

    b8c76065042d1557af857a48a5ac0f3e

  • SHA1

    7b5077cd4aaa5c97a768e9722828ebac94abe1f8

  • SHA256

    e5dcf030290fd293d259f1c8ffbb65328c371e07fa34419af7723429599a7f6e

  • SHA512

    59aa84a81ac66288b0d9b2d160ce6c3895d5a02bd48bceff659aeaf21df28c4996585378d302535f50b06d0592d65b5e6612714f7bec4d0df39e9bf514d54eba

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2