Extracted

• • Target

    d97a38c3bea371da6d9dfaee99ed039d.exe

  • Size

    4.3MB

  • MD5

    d97a38c3bea371da6d9dfaee99ed039d

  • SHA1

    1fec3033a83b2ceea2f34bf81fc0929d2570fbdd

  • SHA256

    df9df29f3c0d3af0e23a5f32be956469661f8f4006162442737452f5c5709744

  • SHA512

    781c60f7af50fd41985afec6a8cc994656505c676a83624e624821a999a92bbb7d0924e06cd4171dbcbed436d34bfae5c865c9b9b6d31acb0f3c48877e34ea1d

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2