General
-
Target
TeamViewer_Setup_x64.exe
-
Size
33.0MB
-
Sample
210929-zla4dsfhfq
-
MD5
4a8e5e6ca45331d7e08c2c44364231fe
-
SHA1
c3c908aaa09783b9b638dfbb1770efd9e77ae5bb
-
SHA256
187ed0e2c02f10ee82731490d0cd9928590d428c80d7c7382ba471df2cb8b9b8
-
SHA512
e33a8406ed003bef4a341b757390f57e753ebd2d73d36b6970de2dafecc9d0092760156bf6bd42b21cd9a78a7abd7cb1b2a5c593d5172b337999800246a2ca1f
Static task
static1
Malware Config
Targets
-
-
Target
TeamViewer_Setup_x64.exe
-
Size
33.0MB
-
MD5
4a8e5e6ca45331d7e08c2c44364231fe
-
SHA1
c3c908aaa09783b9b638dfbb1770efd9e77ae5bb
-
SHA256
187ed0e2c02f10ee82731490d0cd9928590d428c80d7c7382ba471df2cb8b9b8
-
SHA512
e33a8406ed003bef4a341b757390f57e753ebd2d73d36b6970de2dafecc9d0092760156bf6bd42b21cd9a78a7abd7cb1b2a5c593d5172b337999800246a2ca1f
-
Registers COM server for autorun
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-