Extracted

• • Target

    8cb590f2b6915a98149d41b605f084cd0d08134ac34812b1b6a67f27615e65f0

  • Size

    4.6MB

  • MD5

    62bb4a8734cacaaea9605ea3b282b6b7

  • SHA1

    134a17660b9c64e35a75c175fa9f5c4bec5b2835

  • SHA256

    8cb590f2b6915a98149d41b605f084cd0d08134ac34812b1b6a67f27615e65f0

  • SHA512

    15b68c65653c7446af02a1c548b7b19a12c9328b5170a0b4f9635eacf11cc62fe8862378f237a97acf68974183904410de5c51ddc4380675cec2d4459c7e06cd

  • SSDEEP

    49152:AHy5JqSxFHuTWN5wqqOvAbCI8whLT5Xz+HavHxp7dU/V4ZNEgyU1:b5JqSxFHuTp+

  Score

  10^/10

  servhelperbackdoordiscoveryexploitpersistencetrojanupx

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    trojanbackdoorservhelper

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Possible privilege escalation attempt

    exploit

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2