Extracted

• • Target

    753f0b9b7183051f2f09ccd68d418969

  • Size

    6.0MB

  • MD5

    753f0b9b7183051f2f09ccd68d418969

  • SHA1

    ffcd59bc747170fcd30032d3ca1da6861330e99c

  • SHA256

    5c7e8b5ecf30c04a3a6e3726328c37eccfc8f0656797894d71e2ac7c27c20c9d

  • SHA512

    1e36d40c6245943430c7ed1dc1ed19a88f930842bc14f478dfee3f91fb18d7d3026312dc8ec856b3982f97d0e93510833945dee0b27533ae6a4130cee0f2dfec

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2