General
- Target TeamViewerQS_x64.exe
- Size 32.0MB
- Sample260627-pezhasbs9q
- SHA256 43af44ff305e330400373dcfbc7f8b6d44d1b756b4f01931f512271526aff60c
Malware Config
Targets
-
- Target TeamViewerQS_x64.exe
- Size 32.0MB
- SHA256 43af44ff305e330400373dcfbc7f8b6d44d1b756b4f01931f512271526aff60c
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score3/10 -
- Target $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeamViewer.exe
- Size 66.7MB
- SHA256 3ad412f837b8135f05af4614da7573dc01a0d15cacee6388cce780e899965485
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target TeamViewer_Desktop.exe
- Size 14.7MB
- SHA256 5e7b50a2efb8e790c5d4f7e91016f0642b3ec9b645abd896deae439dc66d23c6
Score3/10 -
- Target TeamViewer_Note.exe
- Size 627KB
- SHA256 68999d362c54f52c607b9c0ee661cbc0fdbc91e2fe858d8d619b1f76fdf3c105
Score1/10 -
- Target TeamViewer_Resource_ar.dll
- Size 365KB
- SHA256 2ffc0cc0975c230e8efb0f6265e6535d2d60981166b00944748611abcc5f20ee
Score1/10 -
- Target TeamViewer_Resource_bg.dll
- Size 429KB
- SHA256 57a4f3429b9fb62fbcf0b179ea16608c5d113d69c6b81198f679ff96b4da059e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeamViewer_Resource_cs.dll
- Size 400KB
- SHA256 eab15c31d5c2cb34191c5a1ac01131dd8fa57e3a4dadeca881edd91c27814444
Score1/10 -
- Target TeamViewer_Resource_da.dll
- Size 394KB
- SHA256 0fada399cc2cc247e543d5dbd4ce97eccdb86fb77bb9a8c9ba30bd598927fbb1
Score1/10 -
- Target TeamViewer_Resource_de.dll
- Size 441KB
- SHA256 a22192918014e92fc5d4c94aaeecb33c3aa455e512e92ea64994c0e1ef3b5d7b
Score1/10 -
- Target TeamViewer_Resource_el.dll
- Size 468KB
- SHA256 7270e95f50ebb78ce5a509b4a5b6adb84a4aad7ee43dcef281830cbef95a9f3d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeamViewer_Resource_en.dll
- Size 384KB
- SHA256 05345444bcf16daea5b0fef442e15cd3dfc45161f82b172b5d65051ce07911f3
Score1/10 -
- Target TeamViewer_Resource_es.dll
- Size 437KB
- SHA256 189c0ee5b1942f28c22e9f34c47d60af2aa6a9fc07ad585c206fcacf20079f7d
Score1/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1