Extracted

• • Target

    4d7fcc25614e0b6efb83dcca19925cfca5f7ea519b6d1ac859c011a9faba9150

  • Size

    4.6MB

  • MD5

    04eea56890bbc52dca52129a16167964

  • SHA1

    cb202a349506896aac49ee46ceb8d1c66c23797d

  • SHA256

    4d7fcc25614e0b6efb83dcca19925cfca5f7ea519b6d1ac859c011a9faba9150

  • SHA512

    22703fc48e0c109d02a3e8fc774bcfbe0390d54a19473985235b50ace594de1101de2379daced1a2cd08ff96884099bdf97c39988de6c2c814c40fe23143893c

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • Sets service image path in registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2