Extracted

• • Target

    45abc0ccd7712ead92f531f4bbf98615703448de661a15457ea7dac3c141a63e

  • Size

    4.8MB

  • MD5

    21345fbca5a55ebf159df33e413f49fa

  • SHA1

    a5241a3aeeffca19e3eb645054fd1b35b4aebcfe

  • SHA256

    45abc0ccd7712ead92f531f4bbf98615703448de661a15457ea7dac3c141a63e

  • SHA512

    53b39836db28209b4b3719ceab8997ca7584b51931cd5454bcf454aa45f0457f84b9cc1061f27b81124e126abdf4b1d110d143bab01d0b23556f0fe22cadfd39

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupxguloaderdownloaderguloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Guloader Payload

    guloader

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • Sets service image path in registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2