General
- Target TeamViewerQS.exe
- Size 30.2MB
- Sample260704-pkr1eafs8t
- SHA256 85e776478737662941543d3132135c98df8f5d7226e2f2ee17b0914d54178da1
Malware Config
Targets
-
- Target TeamViewerQS.exe
- Size 30.2MB
- SHA256 85e776478737662941543d3132135c98df8f5d7226e2f2ee17b0914d54178da1
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score3/10 -
- Target $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
Score3/10 -
- Target TeamViewer.exe
- Size 62.1MB
- SHA256 14d75d4e95e5d1ec5ef3c4132cbf99e1e5a131058573c06127436f5f6db7d0d2
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target TeamViewer_Desktop.exe
- Size 16.5MB
- SHA256 e9d3d4beaef9592dd3b4a11964147332d75d819523b3d9546853a3bfaf5b4475
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeamViewer_Note.exe
- Size 568KB
- SHA256 6c9f43eb645c654d41b4334bbb5336c0c3aa956ce47188cf755364a9027722e2
Score3/10 -
- Target TeamViewer_Resource_ar.dll
- Size 364KB
- SHA256 4d3043ee9322a9e6f42005d9922829e7185a02a4337b9580400aa20e40d8577d
Score1/10 -
- Target TeamViewer_Resource_bg.dll
- Size 428KB
- SHA256 e430a0bbeaf985e3dfdc6abe56a6c8a0cfd3c4e8b341b692ad7bc416594334fc
Score1/10 -
- Target TeamViewer_Resource_cs.dll
- Size 399KB
- SHA256 9f2a392c964ffca2853748ddab3a404cb1aa5c3f8d428d41bd3b77c861480159
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeamViewer_Resource_da.dll
- Size 393KB
- SHA256 ce3c8ea8dc119d783c0400c40eaba2dd7543cef2583b0b63a7f422e69fc3f877
Score1/10 -
- Target TeamViewer_Resource_de.dll
- Size 440KB
- SHA256 0b9a061a9bfad5c5b66a8915865dda918b7b44916d53586f37823e568cc7eb53
Score1/10 -
- Target TeamViewer_Resource_el.dll
- Size 467KB
- SHA256 36e16f606ebb2a66133758839ac02192160ea1cb90817204d03391fccae90496
Score1/10 -
- Target TeamViewer_Resource_en.dll
- Size 383KB
- SHA256 2a917218213bdbba5b06baf6b254543f2e8fe543a13b8771455dc084f81f0538
Score1/10 -
- Target TeamViewer_Resource_es.dll
- Size 436KB
- SHA256 bf49017ac0155237fe959429f95ae87c64ea76664f0f9a9d0c8c577c3b1a76df
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1