Extracted

• • Target

    979d0a6a47f5f3f282badec05e9e6040d44200b1bbf730efe65f9a48b5d3c34e

  • Size

    4.5MB

  • MD5

    e9fae6305a1e589c8b63bb9ce114b2bc

  • SHA1

    0f2f0b98ce5a51595a91b6ebb43dfc4f10e94ecb

  • SHA256

    979d0a6a47f5f3f282badec05e9e6040d44200b1bbf730efe65f9a48b5d3c34e

  • SHA512

    2b92d944165910640cd8e79278dddbf314f3e6257e8293346905a6f2d658cfc98ef6a5077e3c37acddad7d8bb7e25ee8ec487fbbf25669f926032877ad7a937c

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupxguloaderdownloaderguloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Guloader Payload

    guloader

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • Sets service image path in registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2