d98d3359f06e5602dfaaeacad48aa41ed402b9ec7bfe4fc471f477f7fcc8456a

Sharing

Copy URL Twitter E-mail

General

Target
TeamViewerQS-ITR.exe
Size 30.2MB
Sample260727-pj49caah42
SHA256 d98d3359f06e5602dfaaeacad48aa41ed402b9ec7bfe4fc471f477f7fcc8456a
MD5 579f956de5b41ab7c1d06df8adf3212e
SHA1 9566af6197d3250ebd5e07b6b1ca281bdae0f3bf
SHA512 3dbf523a9b839ec6525f111746cd687fd4ad64e37621669fad42a3ff18b85522bf6dc1a02d5b261233d449cc7e5fefdfa7f05802052daba8d0a10a15d9b0dcea
SSDEEP 786432:mirS1rhagcGABB3JwJl3t0mSosQgKt75k8NX4HCwODXxx:mdrha9D6l9tSbQgKBqW4HM7j
TLSH
T11E6733B12D56BD07DF32ED7133590E4FE9E39D441C42600FEE6EB2A64E387120AC656A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  TeamViewerQS-ITR.exe
- Size 30.2MB
- SHA256 d98d3359f06e5602dfaaeacad48aa41ed402b9ec7bfe4fc471f477f7fcc8456a
- MD5 579f956de5b41ab7c1d06df8adf3212e
- SHA1 9566af6197d3250ebd5e07b6b1ca281bdae0f3bf
- SHA512 3dbf523a9b839ec6525f111746cd687fd4ad64e37621669fad42a3ff18b85522bf6dc1a02d5b261233d449cc7e5fefdfa7f05802052daba8d0a10a15d9b0dcea
- SSDEEP 786432:mirS1rhagcGABB3JwJl3t0mSosQgKt75k8NX4HCwODXxx:mdrha9D6l9tSbQgKBqW4HM7j
- TLSH
  T11E6733B12D56BD07DF32ED7133590E4FE9E39D441C42600FEE6EB2A64E387120AC656A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 1.1MB
- SHA256 6428451d60cb29e9a8a3e1fe60d92819ad6861634128e5dd4492086be40001de
- MD5 730ca4cb5f0906df655ad9d8e7c50bb1
- SHA1 f806ccb294670e0a577c6d42ce2b837d1069344a
- SHA512 832b959b3bad146193c7c68b68ca54d06a5f3860a9c3c54f02484663774f029714b3ed6536c422a8b8f69d4b8092604584983c3fb99d52e025b561abe8d17bae
- SSDEEP 24576:19b0VwvSBZ94iKq0CW+lTt41d6fWZ8flP/KMc9xKh:nWwqBZgCW+lTmX6fI8IMExKh
- TLSH
  T1E8355B227511C036E98A12F16D3DEFEE869C6D340BB594C7A7C43EAA99304C37B35693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 30KB
- SHA256 018cba12efaab3ec61cfa2c54772f0e070452d57f2fc71026826fd7e3f59bd39
- MD5 bcb13343ab422d2c7ce98e324bd02c8b
- SHA1 b6e633426c0d9f3d1f2ef0cf4a27218974da1f7f
- SHA512 dfa02415b6c2003eae5b19f49726536d023bf72dc1e4f123906c1e2fe6200473db8e674e94947f6e07f8cda9e0bbe28cab968225968ee832b8e4bfc5997240b7
- SSDEEP 768:V3wCtynHJAIl0CU4K7yAB8tpVdDQJNILw7/YiW+LZPxWEJY:ttypAY0WqVB8tpVdDQJNI07/7LPxA
- TLSH
  T182D26A66897048B1F97788B4B1E03E232A7DFD0258A0D5E713EB86055A603437B7E73B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 62.0MB
- SHA256 bc8763f14f3212fbc084f281a5d63e95fb982eeee8d3dde416326644f749e8cc
- MD5 38ce0f1df949bb531623717e761c5391
- SHA1 e26cbe441c037490a1bc48518d5bf6edb091a3a6
- SHA512 c30c7c4fa57bb8cfa08343a4cd303e2e69bd4cddf14e94b41868d63f539a2f86de3dd8ac48101757247310a1a66b15e8dcb88a118ff9d7ebd73bb33c72a2df77
- SSDEEP 1572864:xpYLkNdwkyagnEjojfPXQMJQvqYp9nykYosYJF2n2ZZDsS/WsVqskJgU+JsZ:suBFi
- TLSH
  T1F8E78E607DC5421DE48781B1E92C577BE52C9F36072084C352D6FA6D29E24E32BB7BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 16.5MB
- SHA256 e2a8ade20042ecc35e6be20fcd9b1a9ae03e5724aaf6d8c406dd443a46fd7aaa
- MD5 39f514c1beca659bf4f7dbdc62e77f2b
- SHA1 b7953c8a581ab189363193991c580982661ed2d0
- SHA512 4d911c21446645fcbe968d3c038a6411ecb653b9720cd75816e02a257d4757ee7df92d0ebdf236c5489d52096856aab518c6507f1d683e530bc77ea6cbd84c1b
- SSDEEP 196608:/a8xunsIE4rFITLXAMoFN/8Po5gsdV76OjnDyk2P836HGjrR/HJTXZGrU2VFV1h:oSeU0MoF3RzWkMEhXaU2fh
- TLSH
  T1B7077D20B3C64663D1C205B18D2DA77B862CDA250FA4C4DB52DCE96A6C74FD33E72B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 568KB
- SHA256 eb62215f5faf67305c82e25aa94644f8f08b5ce901948cd9885f1ae335c874fd
- MD5 a523a018a362e2f441a9e5a5e90f045b
- SHA1 0830380504856f59670148ff7cfedf2a6c4df32d
- SHA512 aad739fc7dd79445053c9ada20d073287be3e48bffcfc5d67bd4bf80ec55a67274c47723056f1694d766ab0cbaee2686a5025445edb65365efc7992e4b540a9b
- SSDEEP 6144:Hf9f/6q/h3VnjvBPjhejNgExuL4/pVmPsfk0UjqaR:Hfr5tjvBPBEx1pVYJZjqaR
- TLSH
  T180C404707D95C423D5528CB1FA2986FFD529AC21FB5854CB7EC43E6AB534380BE32A06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 365KB
- SHA256 59545f2923ca8f45441385a4db5444f4e0500127fd79de5ff07eb5accbe79621
- MD5 3a8db6da621175fcef043e29eee556bc
- SHA1 cbe597edb45b92656d25ea3b56dc93651efe4d3a
- SHA512 04e3a17c4a885e9b09ad6b18a097c7f58c2e403dabe604c6e65e3a095f85b53e09f7ad0f72261620240fe253b84d5b58441f053dad0876842f5579f8ee58b040
- SSDEEP 3072:MJwXB9xTDhh/uWFbROh+jhUuZnJxy/lmBdVLB99lF6UJ7N/hG:MAxTzuWvb1hjdVz9lF6KA
- TLSH
  T14B84BA011E9CC23CF4A7A738C523C653526E656BDDED723F46388A281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 428KB
- SHA256 1cc3673188801d65b79cb6142d5fcfdaf4fd335aa4824003a9c8f64758aa11cf
- MD5 c2fac41f877daf9dd2bb063642d84f72
- SHA1 980e2cbee14d756d4caaded5c11674c5f2429675
- SHA512 410aed59d93989dbe90d624cfe23780a083cbb572abcf878acd14084d7e79fab04728565cba13482299f05925968b8915e17816cd100c9b3482ab15c39591e07
- SSDEEP 3072:t0yjFn5PqZ9ysAODZpRgBr+9IaYo5pIOoNSkxhJQphhtrRa9WQ97WfmP/jY:tuI4rrSPzPLY
- TLSH
  T11394310FB9BD9240FA69D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 399KB
- SHA256 e2fd1bf82f587f323d8092193b342b4aa4e282874ff3117672b84f424d33d928
- MD5 20a937a77398a429df47636a57cf96c8
- SHA1 1651f5d6c8d515ff3f24f8a10bbd6dc5fb363dfb
- SHA512 50cfa3f33892470f54c49a73dff6e8cb7aced4b0e4c6b9562f192958a049793f3a762edfbde7a4703dc3b79d4aace49c5bbff0d06046b2ada66b011ae9ac7b40
- SSDEEP 3072:ZhvkkALenmGn5ea0slL/LbDWsQOBY3KBtQA3LP6ZLRxjMaWg5iCFAVgZCx1zoUPW:ZlGs2MginCQR4vmUc7Jrbt26uFzP
- TLSH
  T19394F30122FC0685F6F7AF76ADB506624E7B7CA2AE35C24F9550439D1D70AC0E8A5B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 394KB
- SHA256 89e67e7f0ef0cfe0b979e13f19827634d0ad916e611b348ba5edc61323f6c502
- MD5 a9e1ab7b35f6ce72af8b26398903d63b
- SHA1 edc1687b1adc97f1552c7d3507801a5e92802d38
- SHA512 8d892faaeee0dce8dfd58dd095873fe8b563d41083083afe54c4cecff0c6684b67e5d2714459c57757cd01ecf3090a1ccdc53e41f79ff75b9befbe588dbd740c
- SSDEEP 3072:KQqpskWpUSPql7P07PRWdZOqCv5OL1SsmnB007JGDzMY+/CDxdjU+fR/k+cvwNcK:KnHcKs5+5QC
- TLSH
  T1D784975123E95209F6F73F34BDB902945ABABCDAAD39D21D1210519D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 440KB
- SHA256 f5e61bfebf56aef9294d8fbb38ec9df7f76f100e051656ca3f534e0540fe427b
- MD5 26d624eae0471bc9de1760e1051cb7e6
- SHA1 511cb9dcaf7f31dd49584aa77ca33b21355a88a2
- SHA512 40421a94441990bf24fa263ff3a6cffdedb8d6b91c8b6b6865f2d31a47fa6e5267084b4a040c7a743d8ab3974b1e694107d0dc76f8ca06f30ad35867c3d9011b
- SSDEEP 3072:1K7PM1HDB74Zp0Fk0k0C0spiVCuuY15XyzTFPT8y1OWZ15Afx9quxM8lsKjSCNHj:12ane1WtT3lUKtn
- TLSH
  T19FA4EB6153E98618F2F37F34AEB862946EB2BCE6FD79E54D1710509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 467KB
- SHA256 194c01809f16765dc252a66966c1990ed0ffd4a43059104b08303563ef850d80
- MD5 55ab5808d876e5dc9b2fdfdccf4ad219
- SHA1 33098c3f0b809985d30fa686f2ca29d3f62736b7
- SHA512 e424e55c6e73be507a9e556e010b819fc9561e544b638784b82f7c4d2233b9a26dec3f1458ac0bcac39393299542f844bb02d8d69461b75450caa40ae2c59605
- SSDEEP 3072:Tcz5zZk1SKMw86TFnb1Kpl4nXIN5Gt5F78zocrJkdd2wdfafa+TAXpyg+CUOPldm:TPTewAD95PNdVaM4aqdcBvZJepqvLvV
- TLSH
  T190A4278D0DFF2711EEEAA9F2583341565AAFF9924828DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32