Overview

overview

10

Static

static

1

TeamViewer QS V11.exe

windows7-x64

7

TeamViewer QS V11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    teamviewer.zip

  • Size

    9.2MB

  • Sample

    230215-1hdksaea6s

  • MD5

    5584609358f190dce39598caf9c00155

  • SHA1

    660e71120385ad91ac3819e7d7298026264b3311

  • SHA256

    5fcc3e36cdd9efe4ae318000c1d991c0df8693a839f82a6212526069c5d9152e

  • SHA512

    cc5ac830e022bc768bd38889b969111223aa89126b9bcd2af116aa392e5f415846c897de69a624f3528f6befc3fdafd81662383b31e24a51e5c10013805a7fcc

  • SSDEEP

    196608:tg2E6whhYzx6WqKMzqZlhswNo2X/8d8BKsQTmXMJ:tg2Xzx6W9SeT08kVaXMJ

Score
10/10
spywarestealer

Malware Config

Targets

    • Target

      TeamViewer QS V11.exe

    • Size

      9.4MB

    • MD5

      199769cacd06b985dc18c32eef5234bc

    • SHA1

      cd69d0b21a375fae431517b53ce6489d8bf45fbd

    • SHA256

      fbe4c2bdb3e870c335f5f9d12967bd04695d0100d97a19b069acbac713ab47a8

    • SHA512

      87ec7583864d176183636d392b17deed78adfaa5d22d07430408562177b1d9e10b95398a1852a19e6e1fed4b91c35ee3cbd9f303be5bbfdf4edcf89b7716e9b0

    • SSDEEP

      196608:sUaqygKJFy1lSC+qCren5HKoJ6qVx+P+HywuPcBEH:VaqF1lSCfmcx6+S7kBEH

    Score
    10/10
    spywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks