Extracted

• • Target

    f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab

  • Size

    3.5MB

  • MD5

    430153f225c19501842717a80283c9ed

  • SHA1

    b53056dd325af27d8c295731dbbe102ace42def6

  • SHA256

    f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab

  • SHA512

    a9051ad3af63a3bed0c63ab7e6ea26a8b4fc944bbf4eca394f1ea07f645c0fd94551fe2b33d86ca62fc86f6ee2ee515ad95b51473511466a679858468cdba8d2

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2