Extracted

• • Target
    74f029d2fd587f9e25091f7832bea2f2.exe
  • Size 5.7MB
  • SHA256 5f0c0223d10468b9130a240432342f4056c6d7c2f6f89469c9d971bcea31255a
  • MD5 74f029d2fd587f9e25091f7832bea2f2
  • SHA1 76fb2d051d6dc938ba2b7131ef1b21c0fe2ad60c
  • SHA512 0386c61a89b414ab50c2c7b371d2bab288bde154da35c643de423622b05e99fcc748f5b0b9e53f8da00e6dccd02cf535b6d41c15fbddfa732a599db3bac45a23
  • MD5 SHA1 SHA512

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencesuricatatrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2