Extracted

• • Target

    67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98

  • Size

    3.4MB

  • MD5

    512608823063f8b9568f67eb89337856

  • SHA1

    57d0fb5026bbc365789b3999a8c35c7a6f79bbff

  • SHA256

    67731976f3ca148c7983dadef66659256d18766ba4f956a40ed3abcf2619ae98

  • SHA512

    ecc7e4783a01f50fa6d7b7415d53d0c75f12c7c979d876f52739a9fbc9b784fb7ae4852a9098956e2c82d7f019c4815e7d8f0d2afcd728e708ae42de557f11fb

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2