General
- Target TeamViewerQS_ARBINFORMATICA.exe
- Size 3.3MB
- Sample260628-pen2kag19n
- SHA256 ce59ac26d678e0384be49ea671a42991d65d2737cd21ea9bf75fbd205746a533
Malware Config
Targets
-
- Target TeamViewerQS_ARBINFORMATICA.exe
- Size 3.3MB
- SHA256 ce59ac26d678e0384be49ea671a42991d65d2737cd21ea9bf75fbd205746a533
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/TvGetVersion.dll
- Size 50KB
- SHA256 b5e3a463393887c08219366ac3efd60e8b4991df874586702950de2baa83104d
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 176KB
- SHA256 0dedad042a306da32784c3ce79bfac0475b827e416c17e1a1dfdb461151f4271
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeamViewer.exe
- Size 6.7MB
- SHA256 1e4189c3847eb147fcb9c5bef2086920e391a9f656506b7291c4d324ade57ee8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeamViewer_Desktop.exe
- Size 2.1MB
- SHA256 ff174a5eed56a04210723681ee4c44d9e854df8f3cf28dd72a56fb350eb249d8
Score3/10 -
- Target TeamViewer_Resource_ar.dll
- Size 1.2MB
- SHA256 f8ce9ea25bcc2dd69bcf4e1ff2612eb500fe2b71ba597a0ebe39221ce4dbbc88
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeamViewer_Resource_bg.dll
- Size 1.2MB
- SHA256 e74bdf13c078bd28b9df84ec3abb2d84c93d85f84d5306a762ab22c9e566b888
Score1/10 -
- Target TeamViewer_Resource_cs.dll
- Size 1.2MB
- SHA256 b11e73a0bf96473c1fd99ebf38fa91b72ffd9acda934b425a4d91c31dbf1b7bd
Score1/10 -
- Target TeamViewer_Resource_da.dll
- Size 1.2MB
- SHA256 534945d754cb0803b9b6b97e843d61ab9bc0ded85e18f8bcb0683c666734bb58
Score1/10 -
- Target TeamViewer_Resource_de.dll
- Size 1.2MB
- SHA256 61aefeea4c0c56aee94511e95ab902a1d6e9f836dbd503d615d3f6713827ff14
Score1/10 -
- Target TeamViewer_Resource_el.dll
- Size 1.2MB
- SHA256 143285cad30574e203dc32306c321d4118d29f2ba16cccdaa8659659457d153f
Score1/10 -
- Target TeamViewer_Resource_en.dll
- Size 1.2MB
- SHA256 de9e35eeb36024037f6a3001aa8459ea6ac47f5392445770ddaeef615eaf93f3
Score1/10 -
- Target TeamViewer_Resource_es.dll
- Size 1.2MB
- SHA256 ca30dee8b1125b970cb80a59c69037e36f6e9e3002ada2915f43636f21009be4
Score1/10 -
- Target TeamViewer_Resource_fi.dll
- Size 1.2MB
- SHA256 990186dcca24fe4daa9e512112ee9c9cf429e46a49f7ec715b4661b305125c99
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1