General
- Target TVQS_es.exe
- Size 3.0MB
- Sample260627-pegmgsav2t
- SHA256 e602ef45c100fdf7548fb3a86c100a00351985680672bef8c53f15165a236bc0
Malware Config
Targets
-
- Target TVQS_es.exe
- Size 3.0MB
- SHA256 e602ef45c100fdf7548fb3a86c100a00351985680672bef8c53f15165a236bc0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/TvGetVersion.dll
- Size 130KB
- SHA256 681cb2b67e87915f37b6f716d53626b939d534c0c3e5e9810ad025760c798270
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 176KB
- SHA256 0dedad042a306da32784c3ce79bfac0475b827e416c17e1a1dfdb461151f4271
Score3/10 -
- Target TeamViewer.exe
- Size 6.4MB
- SHA256 0f7734f333279350dc9e20ebba61cf02b5b26378bf394e7c2c0701d4404274ab
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
- Target TeamViewer_Desktop.exe
- Size 2.2MB
- SHA256 7d85e125d0f1553797a165b8d409a8b4c52743c82b602b4c2aec1f67e9813366
Score3/10 -
- Target TeamViewer_Resource_es.dll
- Size 252KB
- SHA256 c75dec93aea4701dd100706f0763a1d38428cda78c6253d22f909812a6179255
Score1/10 -
- Target TeamViewer_Service.exe
- Size 2.6MB
- SHA256 a2fc05250de0c2e31d843608e7b268f17738fdab11de7f09d608ced468f8a149
Score3/10 -
- Target TeamViewer_StaticRes.dll
- Size 2.4MB
- SHA256 0b6c90a473e91194097e2bda37dbc12da2aad821746e33007b993e3fbf822435
Score1/10 -
- Target tv_w32.dll
- Size 65KB
- SHA256 fbc5878e2c1e7b07a51373ca2c7831692c8c2670cceb11dbc74ae52e5cbdfe98
Score3/10 -
- Target tv_w32.exe
- Size 103KB
- SHA256 39d4d07bb3a5a09c95d13e61dda88f4051dc032941cca24ca37687b026d7f9b2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target tv_x64.dll
- Size 78KB
- SHA256 89665638b0a1d14ab7b41647124a2f0ab1f392567e82da64ff3b1c9fd862acf8
Score1/10 -
- Target tv_x64.exe
- Size 126KB
- SHA256 b04856d833675181328d4a735f4986c9152a91b7e9fdf6fc4366e0c33bd89346
Score1/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1