Extracted

• • Target

    74f029d2fd587f9e25091f7832bea2f2.exe

  • Size

    5.7MB

  • MD5

    74f029d2fd587f9e25091f7832bea2f2

  • SHA1

    76fb2d051d6dc938ba2b7131ef1b21c0fe2ad60c

  • SHA256

    5f0c0223d10468b9130a240432342f4056c6d7c2f6f89469c9d971bcea31255a

  • SHA512

    0386c61a89b414ab50c2c7b371d2bab288bde154da35c643de423622b05e99fcc748f5b0b9e53f8da00e6dccd02cf535b6d41c15fbddfa732a599db3bac45a23

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencesuricatatrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2