Extracted

• • Target

    2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f

  • Size

    4.2MB

  • MD5

    470602a8aa144556803374fb94a210aa

  • SHA1

    a04b54e71646fd4f70fec7a24b44932079755f5e

  • SHA256

    2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f

  • SHA512

    24020ea5d03d5b4527d24b7cc531729771e714e180d85fca8b1a8e01211f1e21fb339ffdcd6d04c1df8a1c2414fe281d86039be025ea92c72ffb3325cc1221eb

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2