a0154c403b0ac58b880aee26f1e7f236fbc60a8c2ad4c97b042f5ea008fcaf61

Sharing

Copy URL Twitter E-mail

General

Target
TeamViewerQS_x64.exe
Size 32.8MB
Sample260529-age44set7m
SHA256 a0154c403b0ac58b880aee26f1e7f236fbc60a8c2ad4c97b042f5ea008fcaf61
MD5 509abefe4668d4adf7a0caf505ff557b
SHA1 c02d9414cf8fd15738ec72dab5b5d23909d69cff
SHA512 16a5a308edb0b541785b4b16d3923f30d321f7572820490d9ec60e936bd5fa074358b5095fc733edfaed5409ee41708e23dae8b9ed0c9cd3e8e7d2e8f725739e
SSDEEP 786432:/RpFGY5V6eOgtE03bujoWHvE/8F/9Z+EdBwlNkRNbIvW6gZni:/TEEVK03yjuilByN3eP1i
TLSH
T10477337ACE18A60AF9EA2E307A2D751F9C762D1425742DDB5D31BB8B213A3420C51FCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  TeamViewerQS_x64.exe
- Size 32.8MB
- SHA256 a0154c403b0ac58b880aee26f1e7f236fbc60a8c2ad4c97b042f5ea008fcaf61
- MD5 509abefe4668d4adf7a0caf505ff557b
- SHA1 c02d9414cf8fd15738ec72dab5b5d23909d69cff
- SHA512 16a5a308edb0b541785b4b16d3923f30d321f7572820490d9ec60e936bd5fa074358b5095fc733edfaed5409ee41708e23dae8b9ed0c9cd3e8e7d2e8f725739e
- SSDEEP 786432:/RpFGY5V6eOgtE03bujoWHvE/8F/9Z+EdBwlNkRNbIvW6gZni:/TEEVK03yjuilByN3eP1i
- TLSH
  T10477337ACE18A60AF9EA2E307A2D751F9C762D1425742DDB5D31BB8B213A3420C51FCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  TeamViewer.exe
- Size 67.3MB
- SHA256 b261874ad05fc0639fdff1749a9fb96e5415e69b060b6a1abe52030749edd39c
- MD5 8597c53f7e55f433420c8e54f66704ab
- SHA1 ef796b2d86e7d5a08468142ab6c72284324e0750
- SHA512 aca9606b84ff78f56fc9fac7edeb11d8651446391915c1f916f0f1f7a60d64e0ad8bb4a153ff5928a9359fda7ebd12259b983abc79644dfe7cdcd191c09113cc
- SSDEEP 393216:Xw8tMYvBzREuwWB1/WgZ1IsM4n/2bay8WtMzXVtsOpdv6U/fncXMMgtolb0nPsiX:ggBNXIH4n/2uxXj/XtrusRYf8wk
- TLSH
  T134F77D17A1E801DDE0BAD17ACAABC917EBB23809033197DF0690965E1F67AF05E7D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  TeamViewer_Desktop.exe
- Size 18.5MB
- SHA256 06825b1f0677b2c6f03bf677e07957220c7b386a57025b5254618b209574775c
- MD5 3fc91dbf333cdb38c9dd099ea3a9af5b
- SHA1 620971c3cdd58e395b01181c5b6e28f2aeb843de
- SHA512 69645e5e108a2218f3f7b84a33b57878299140a5052b41b9abcef2453eb5fef5c9a96e7d65c64b02b5a41a23ab7c376213c1eed37026acdaa9b163adcc8afaf1
- SSDEEP 196608:U6TezARRu36mB7Fw2BmgHF0whdXmx/VFkibzEG:FrRRu36mVhdXmx/RXEG
- TLSH
  T1DA178E1BA1E801DCD0BAD179CA5B9517EBB1B80903B157EB06D085A62F33EF06E7D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion spyware trojan
behavioral13 behavioral14
- Target
  TeamViewer_Note.exe
- Size 628KB
- SHA256 6f56e7950621520f7c946168b79331914702b7807b35f58121223ff6689bd3ce
- MD5 13c01d339297e7f5d272849e4f830e22
- SHA1 0f831de387b491309aea1dc2deb44f83978a2189
- SHA512 9877ed5524e0ba673536f5e0cacde5e79cbe2aae361856ab97cf6005b78d608a2ec0faeea0edb60ecc37b3b1cd38731ce4006e39325455a0b25aff718f77892f
- SSDEEP 6144:eZ+uCHz7j2sHbUkArwu1U/eTXFLqmBIQ5LFr/yQcLLyX37yi9ivD/:5hzS9FyQcviO0ivD/
- TLSH
  T1EED46D75BDD8D0A7D4268CB4F94A40FFD6216C22F758958B3EC07E5A3A32790BD39A01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion spyware trojan
behavioral15 behavioral16
- Target
  TeamViewer_Resource_ar.dll
- Size 365KB
- SHA256 59545f2923ca8f45441385a4db5444f4e0500127fd79de5ff07eb5accbe79621
- MD5 3a8db6da621175fcef043e29eee556bc
- SHA1 cbe597edb45b92656d25ea3b56dc93651efe4d3a
- SHA512 04e3a17c4a885e9b09ad6b18a097c7f58c2e403dabe604c6e65e3a095f85b53e09f7ad0f72261620240fe253b84d5b58441f053dad0876842f5579f8ee58b040
- SSDEEP 3072:MJwXB9xTDhh/uWFbROh+jhUuZnJxy/lmBdVLB99lF6UJ7N/hG:MAxTzuWvb1hjdVz9lF6KA
- TLSH
  T14B84BA011E9CC23CF4A7A738C523C653526E656BDDED723F46388A281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  TeamViewer_Resource_bg.dll
- Size 428KB
- SHA256 1cc3673188801d65b79cb6142d5fcfdaf4fd335aa4824003a9c8f64758aa11cf
- MD5 c2fac41f877daf9dd2bb063642d84f72
- SHA1 980e2cbee14d756d4caaded5c11674c5f2429675
- SHA512 410aed59d93989dbe90d624cfe23780a083cbb572abcf878acd14084d7e79fab04728565cba13482299f05925968b8915e17816cd100c9b3482ab15c39591e07
- SSDEEP 3072:t0yjFn5PqZ9ysAODZpRgBr+9IaYo5pIOoNSkxhJQphhtrRa9WQ97WfmP/jY:tuI4rrSPzPLY
- TLSH
  T11394310FB9BD9240FA69D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  TeamViewer_Resource_cs.dll
- Size 399KB
- SHA256 e2fd1bf82f587f323d8092193b342b4aa4e282874ff3117672b84f424d33d928
- MD5 20a937a77398a429df47636a57cf96c8
- SHA1 1651f5d6c8d515ff3f24f8a10bbd6dc5fb363dfb
- SHA512 50cfa3f33892470f54c49a73dff6e8cb7aced4b0e4c6b9562f192958a049793f3a762edfbde7a4703dc3b79d4aace49c5bbff0d06046b2ada66b011ae9ac7b40
- SSDEEP 3072:ZhvkkALenmGn5ea0slL/LbDWsQOBY3KBtQA3LP6ZLRxjMaWg5iCFAVgZCx1zoUPW:ZlGs2MginCQR4vmUc7Jrbt26uFzP
- TLSH
  T19394F30122FC0685F6F7AF76ADB506624E7B7CA2AE35C24F9550439D1D70AC0E8A5B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_da.dll
- Size 394KB
- SHA256 89e67e7f0ef0cfe0b979e13f19827634d0ad916e611b348ba5edc61323f6c502
- MD5 a9e1ab7b35f6ce72af8b26398903d63b
- SHA1 edc1687b1adc97f1552c7d3507801a5e92802d38
- SHA512 8d892faaeee0dce8dfd58dd095873fe8b563d41083083afe54c4cecff0c6684b67e5d2714459c57757cd01ecf3090a1ccdc53e41f79ff75b9befbe588dbd740c
- SSDEEP 3072:KQqpskWpUSPql7P07PRWdZOqCv5OL1SsmnB007JGDzMY+/CDxdjU+fR/k+cvwNcK:KnHcKs5+5QC
- TLSH
  T1D784975123E95209F6F73F34BDB902945ABABCDAAD39D21D1210519D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_de.dll
- Size 440KB
- SHA256 f5e61bfebf56aef9294d8fbb38ec9df7f76f100e051656ca3f534e0540fe427b
- MD5 26d624eae0471bc9de1760e1051cb7e6
- SHA1 511cb9dcaf7f31dd49584aa77ca33b21355a88a2
- SHA512 40421a94441990bf24fa263ff3a6cffdedb8d6b91c8b6b6865f2d31a47fa6e5267084b4a040c7a743d8ab3974b1e694107d0dc76f8ca06f30ad35867c3d9011b
- SSDEEP 3072:1K7PM1HDB74Zp0Fk0k0C0spiVCuuY15XyzTFPT8y1OWZ15Afx9quxM8lsKjSCNHj:12ane1WtT3lUKtn
- TLSH
  T19FA4EB6153E98618F2F37F34AEB862946EB2BCE6FD79E54D1710509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_el.dll
- Size 467KB
- SHA256 194c01809f16765dc252a66966c1990ed0ffd4a43059104b08303563ef850d80
- MD5 55ab5808d876e5dc9b2fdfdccf4ad219
- SHA1 33098c3f0b809985d30fa686f2ca29d3f62736b7
- SHA512 e424e55c6e73be507a9e556e010b819fc9561e544b638784b82f7c4d2233b9a26dec3f1458ac0bcac39393299542f844bb02d8d69461b75450caa40ae2c59605
- SSDEEP 3072:Tcz5zZk1SKMw86TFnb1Kpl4nXIN5Gt5F78zocrJkdd2wdfafa+TAXpyg+CUOPldm:TPTewAD95PNdVaM4aqdcBvZJepqvLvV
- TLSH
  T190A4278D0DFF2711EEEAA9F2583341565AAFF9924828DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_en.dll
- Size 383KB
- SHA256 208f64705f7d37855dab60f7c9ef6ce4e67bdf57fd1c93373ed1965ed41bfa82
- MD5 c06087554a7c708b4c0d4ff46e04e6eb
- SHA1 9718d923633be11b76c29fee66f76c453401d59d
- SHA512 b471f69f3def6a6ce69f19492b815609b510218947b8fa6ca977b8acafe59a9eec78b2cd00348bc464b32067129aa0352641388fc4f22f28dee0ee215bd0ed39
- SSDEEP 3072:U6g8C3PdpSnTIgSU73g4WK0yfsP7nMJ7WkQ539L3qJvuq1khE/i:Ubp1AsDnqCz5Z3Qra
- TLSH
  T19D84965163F94608F6FB7F74AEB926604E7ABC96AD38C29C1250405E59B1F90DCB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_es.dll
- Size 436KB
- SHA256 24cde7724b616f848324f022a69cb16191871f2538ac8ad90465c4a8981455aa
- MD5 75f3c08c784939f72b1c3675bd453a6f
- SHA1 5950bae704de4c9a64ef041764bb890e200b6bde
- SHA512 f5ce21236dbc00360902cf496ef1912af4113ab52787923eaac129817e61f0ad70020aed3e3233e9878ee520d4048bccc5950223d7bfa09c2e2049ac5ba3c496
- SSDEEP 6144:/L7AATWp3th20F8uUHEOs379eLh+aLXy2+iAR5KE6y7YJ2hQd2iEZf5lEnnzOqo:Iko
- TLSH
  T18494415067FD6246F6F37F38A97916658E7ABD92AC38C14D4220525E0DB0E84CEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32