Extracted

• • Target

    1aa9dda1b9b413444b0668500611c7f3

  • Size

    7.2MB

  • MD5

    1aa9dda1b9b413444b0668500611c7f3

  • SHA1

    d980ac83bf107df1a7510ad94304a7e364d927a5

  • SHA256

    02031c62d916cdd41d26a271e93ec5b06eabfa910187207b02ead07fd480c2a9

  • SHA512

    37a301fd61c42c10f774950826469f215a20a24d783316febfeafd0fa06d88f536daa4d5d10153fd1ec42cc778d87716fe5b4bb9782c03e86a4e3b336e9efd53

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2