735262d6b7f50a669d4d53d567b2c4b252c5293f9cf2a574bbf4885199a67589

Sharing

Copy URL Twitter E-mail

General

Target
tavsegitseg.exe
Size 29.6MB
Sample260502-pffftaav8n
SHA256 735262d6b7f50a669d4d53d567b2c4b252c5293f9cf2a574bbf4885199a67589
MD5 4cbd865fa4e3f5618d41122204a34ea7
SHA1 a00620364997b4ebc4e36e331a04832edb32aa4f
SHA512 db555dbb3fa2954c1574ba39969bb3063591a6dc5e3a71a8a483571289afe3be41725a6937cf9a59346faccc6d76cf602c35ae93fd03fff2ed6536081a8439d9
SSDEEP 786432:vWI4OJXIqSJkT9qlx8sE38GvGRBE3aPSeGKMhwAPH:vWI1YfkRqKM+R3aHGTH
TLSH
T13C67337B2A40A543DACA5E76F92617AFEDEA1FF3704085932C4A72879033375FD411A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  tavsegitseg.exe
- Size 29.6MB
- SHA256 735262d6b7f50a669d4d53d567b2c4b252c5293f9cf2a574bbf4885199a67589
- MD5 4cbd865fa4e3f5618d41122204a34ea7
- SHA1 a00620364997b4ebc4e36e331a04832edb32aa4f
- SHA512 db555dbb3fa2954c1574ba39969bb3063591a6dc5e3a71a8a483571289afe3be41725a6937cf9a59346faccc6d76cf602c35ae93fd03fff2ed6536081a8439d9
- SSDEEP 786432:vWI4OJXIqSJkT9qlx8sE38GvGRBE3aPSeGKMhwAPH:vWI1YfkRqKM+R3aHGTH
- TLSH
  T13C67337B2A40A543DACA5E76F92617AFEDEA1FF3704085932C4A72879033375FD411A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 1.1MB
- SHA256 6428451d60cb29e9a8a3e1fe60d92819ad6861634128e5dd4492086be40001de
- MD5 730ca4cb5f0906df655ad9d8e7c50bb1
- SHA1 f806ccb294670e0a577c6d42ce2b837d1069344a
- SHA512 832b959b3bad146193c7c68b68ca54d06a5f3860a9c3c54f02484663774f029714b3ed6536c422a8b8f69d4b8092604584983c3fb99d52e025b561abe8d17bae
- SSDEEP 24576:19b0VwvSBZ94iKq0CW+lTt41d6fWZ8flP/KMc9xKh:nWwqBZgCW+lTmX6fI8IMExKh
- TLSH
  T1E8355B227511C036E98A12F16D3DEFEE869C6D340BB594C7A7C43EAA99304C37B35693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 30KB
- SHA256 018cba12efaab3ec61cfa2c54772f0e070452d57f2fc71026826fd7e3f59bd39
- MD5 bcb13343ab422d2c7ce98e324bd02c8b
- SHA1 b6e633426c0d9f3d1f2ef0cf4a27218974da1f7f
- SHA512 dfa02415b6c2003eae5b19f49726536d023bf72dc1e4f123906c1e2fe6200473db8e674e94947f6e07f8cda9e0bbe28cab968225968ee832b8e4bfc5997240b7
- SSDEEP 768:V3wCtynHJAIl0CU4K7yAB8tpVdDQJNILw7/YiW+LZPxWEJY:ttypAY0WqVB8tpVdDQJNI07/7LPxA
- TLSH
  T182D26A66897048B1F97788B4B1E03E232A7DFD0258A0D5E713EB86055A603437B7E73B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 61.2MB
- SHA256 fff59113679364b9fe470b91fcba3522c5441e379cf88926a5261537304b7ad5
- MD5 762ce97fa241d690d487395815d4c49d
- SHA1 bb20317b6934a91d3c8aa87ec23fb5e9a02eb490
- SHA512 e1e462dc38c612d23b1d8f66f16a48038021a1e2b0335538160288be6b79c09e029acd1fe37d2460751f119d69cbced6f029e6536ed30e985fea3ff6b8d0e2dd
- SSDEEP 1572864:0xbQsCBGxNmqjKW1kDpWpJkeO4HHgW8hSn4tnMSiUL14FXEPHOFM4n4oxopFr:GQtM4P
- TLSH
  T1A8E77D30B1C94125D583C1B1E92C677AA52E9923476CC4CFD2D4EA6EFD234C32B36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 13.1MB
- SHA256 d536ece7cfa689754dd76c7c481e104afab0d2dd9f0511840f7affc10894af16
- MD5 09982cc8fe2f9bdb89807bd7b551df82
- SHA1 6893617cac96258d9b7db505ec15951e5b07cb57
- SHA512 6ac3a98142afc20e8a415ac969a6ed5a01005228b63b48b04cb07f58fced3479e13bad3e2c3d40db6562efdc0bf09bbd74dffeb57ae913291a5296c5f44662f8
- SSDEEP 196608:kOvZEwNh/fC83cniiPnWewwokMbYTSc4iYqVFVv4S1:F0i0WePzJ4iYqRb1
- TLSH
  T1E4D68F52B7568037D18600B1DD2DA77A872CE92907F284E7A2D0F9D96970AC23F31B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 567KB
- SHA256 48c7c5846f9702bef8f82c784a8429b7e856793ab1132523666563ebc0b8bb03
- MD5 b87be76bc11913c105da43530476d11b
- SHA1 bd138ecd963ccb32e2841c583494d236d3040370
- SHA512 2212896fd662075684896b5b2fab336294b27174ebe7a684d86d5927231198d80406bd0cd5487dcdfd593c4ef1709fc15eea68eeee4d1e3d2cddb5cf05710069
- SSDEEP 6144:egGlQCOIFn70MnecE0ThOjugEAuL4vq1jsprQfjq0:4H97PecE0AEAlqFsR2jq0
- TLSH
  T1EAC4F4707C99C423D5528CB1FA2986FFD529AC21FB5854CB7EC43E6AB534380BE32A15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 364KB
- SHA256 b2a5456c411811ff43888463cbf3fca53f9999ca75f210d17dcf1f66148a53c4
- MD5 fb610ba45b1afceaf9675485ba9827ca
- SHA1 98448e33a4fc821b57c481e60815bdf452211b58
- SHA512 19dfd5b80c5cc030b4f0cc4f2fcc5c0cf33c6055714f104d0730a78400a07a5a03fd22c4e282401e4c2f6e8c746017ae2bdbcc6179608477a0f267cb30d09536
- SSDEEP 3072:OEPBVB9xTDhh/u1LmRO1+sU/ZnJxy3YlmBdVLv99lF64O9z/d3:OEvxTzu1M/hodV59lF6LB
- TLSH
  T1D484BA011E9CC23CF4A7A738C523C653526E656BDDED323F46788A281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 428KB
- SHA256 556fb8fc1e32c206b8f7e6cd76d63e39a6af4dda98771f408968abc0a877b4a2
- MD5 cba33d4e7e6ee2505cb713a6700d8804
- SHA1 53b019de4a3626b831b4a1a5c5cc832a9b88e2e5
- SHA512 71a974c7158bd46d7ddbc6073df4b55d6551877a9322e56d6779fea8a6f252956d3854a517bf6026e5b4e7cdf2fd57330a6ff252e13bb8fefa93d15b526a195f
- SSDEEP 3072:nAIjFb5PqZ9ysPeDZpRRBr+9BbYoypIO/NSkxhdQpCZtrRa9W+97bfmM/:nMnirUy6EM
- TLSH
  T1BE94420FB9BD9240FA69D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 399KB
- SHA256 8612c4e13d171b09fe3f0dd7d79360b54acd2ce65293ccb0333824fa62afe9ad
- MD5 b9da2b36f828e90d7304f584b5f0287c
- SHA1 402ab630236fc1d1285c7b5895bc2dc16ea76e5a
- SHA512 923757801cd383d3b3832bc639fb0696357d92c404404a282d1d520fdf4d33af310dd1b16c2fd96211911be1f20d34608b25877eb21692215da708693e0f2cc5
- SSDEEP 3072:PYFtkkALenmGn5ea0slL/LbDWsQOBY3KBtQA3LP6ZLRxjMaWg5iCFAVgZCx1zoUY:PYbGE2MSWC1RQvZUc7Vrbt260B0C
- TLSH
  T1B994F30122FC0685F6F7AF76ADB406624E7B7CA2BE35C24F9550429D1D70AC0E8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 393KB
- SHA256 66345f7aa6f74613d4c63d7c202eb4df71a4694e98f3e270682c51ef49030340
- MD5 8f326b6a55048d0cdf14b889b116ac61
- SHA1 966587c4d23e436e623dff8709414e6720abbc2d
- SHA512 6ca2a09d5b750da72dab0ef9dbe19becb19ff6fba30402b2837dd1a16db8d4e4df3731fc4258a1e11b4eaac35433d9b029162e3b177dd9d02ebb804515b8c508
- SSDEEP 3072:FZHYo7ApskWpUSPql7P07PRWIZO5Cv5Od1jOmnc007JGDzM0+/CDxdjU+fR/k1c:FZyHzJsN+k
- TLSH
  T18B84975123E95609F6F73F34BDB902945ABABCDAAD39D21D1210509D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 439KB
- SHA256 d122bd2b1a0f1fc25412e432c96161f555b29ed551a0a7397e7c3d424ee4c424
- MD5 5dde55358615e8044576a3c6cd289fa3
- SHA1 5930ffc1c2304d1dfc7a3b303ab7c161823a46f8
- SHA512 fcc77e4eea1996595281629b5c06d136e04e5e0cb4ea8b1dd265ea79c5fc90395c7b54ab7ee5950ba45c52bb76efdb1a1ed120664ddea01d5a1619393e4d51c2
- SSDEEP 3072:NLJPM1HDB74Zp0Fk0k0C0spiVCuuY15XyzTFPT8y1OWZ15Afx9quxM8lsKjSCNPb:NDSaeDWtTHlUw4P
- TLSH
  T1ECA4EB2157E98618F2F37F34AEB862946EB2BCE6FD79E54D1710509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 466KB
- SHA256 42432c427564c4afd6d76f456eff8002a5e2acb7085cd744cd94b3760a5f8a71
- MD5 a7d7e939dd75a06e706d1b0f9d438189
- SHA1 7c0261d828fdd161ef6ca10070259bcfa1b2e7cf
- SHA512 73ba9cacff28c039a35d51e46b8a078c5f8654fa14840d5c7f1d5e716cb3711acd40a173120e24db0c1850bb236f10ad3713ddf0aebb3e5dcf7c8a51d50362ed
- SSDEEP 6144:6jxTng1D9jPNdVaMpaqdcBGZJepqvmiX:EhgEtQ1
- TLSH
  T1B1A4278D0DFF2711EEEAA9F2583341565AAFF9924828DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32