8216f35ee79dac6bda3863064d4288831192ce31ab752d27a3094d17425eaab5

Sharing

Copy URL Twitter E-mail

General

Target
eitechsupport.exe
Size 15.2MB
Sample260730-pj56msxdma
SHA256 8216f35ee79dac6bda3863064d4288831192ce31ab752d27a3094d17425eaab5
MD5 7dad9a1b128f145c85a4859cd319436e
SHA1 7d829bbce1e643c8c50b57b05179b0c12654ddd5
SHA512 e182a7c872e03aef4a4f21c4286cc8833b1dd7840c4f7d1b6022c95d376b58021a7df6a86b0f3bd79c0b184f7f8f5191437d00e0ee234a473869f1452eddf183
SSDEEP 393216:uUclZsnAiEWl9kbQ7at4CIOzXzsv9BDrpyDy2H2dah:udlLiEWFatNIqjsv9xEucIah
TLSH
T1B7F633E4E3E74697F8316A36D342563824313FD464E46CFA4AC9BA2C89701DED21F96C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  eitechsupport.exe
- Size 15.2MB
- SHA256 8216f35ee79dac6bda3863064d4288831192ce31ab752d27a3094d17425eaab5
- MD5 7dad9a1b128f145c85a4859cd319436e
- SHA1 7d829bbce1e643c8c50b57b05179b0c12654ddd5
- SHA512 e182a7c872e03aef4a4f21c4286cc8833b1dd7840c4f7d1b6022c95d376b58021a7df6a86b0f3bd79c0b184f7f8f5191437d00e0ee234a473869f1452eddf183
- SSDEEP 393216:uUclZsnAiEWl9kbQ7at4CIOzXzsv9BDrpyDy2H2dah:udlLiEWFatNIqjsv9xEucIah
- TLSH
  T1B7F633E4E3E74697F8316A36D342563824313FD464E46CFA4AC9BA2C89701DED21F96C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
- MD5 033ee34c40e8fa85bf2739bcb2f3e186
- SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
- SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
- SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
- TLSH
  T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- TLSH
  T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 210KB
- SHA256 c67cbd5e35e1ce0c7ba17c55d8e2bc33afd5e0a68774554a1fe7216d330c709e
- MD5 05f51bc8ffb2c8f5a2825bf5680301cf
- SHA1 30f7f77dce1fb3526142780e9f5bd5c11622d6b6
- SHA512 1e041aaa37dd00414ad955ebc8c0f708589014d2085a5a0b95a31f4d694bb1cc4994bb1324d4b983cbad0449fb0a05560d82c60fdbfc78be67ff61275e451233
- SSDEEP 3072:4J7KJkcma0VkpOG/374vnriZ1nmTaK405/+ncMCQ2bDh:6EkcmYOG/37MnGZoeKxpuuQ
- TLSH
  T1D7245B0177E4843AF2F726746DF6C6604EBDBC725934D18FE780892A2E70A85DB24727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  TeamViewer.exe
- Size 33.1MB
- SHA256 3262eb64ca5a7920f126dcd20e6dcebc14f1a57642d6a56c15169c90be2fb5e7
- MD5 4f283436e5b309b1e729e907c6170a91
- SHA1 9f03f91caaefdb3b98a7e575d169c60ad92521ad
- SHA512 63444c4d9ccf6d2f4df0befce32b5f786f48c41eacb64f188f8238b92ed56e58c3852130d9907c4908ee57df6ab85324e29cbe57339d2f15ce5e162562010cfc
- SSDEEP 786432:oKtczNtjbq6daavMgD6KCn57Xb1O3ZRi8cSukp/:ltczNtjbxdamzDsnnK3
- TLSH
  T117774D31BA46C65ED95282F16F7D991BC32CAF5407A448C7D398BD6F38349C24A33E26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral11 behavioral12
- Target
  TeamViewer_Desktop.exe
- Size 9.6MB
- SHA256 db589c12e0c27f942a85a84734a932acdb5c8e02edab19d9b1cede61b90e0067
- MD5 39d04ea52dbc16c546cfb34aca3daf0a
- SHA1 ea2fc05621e320886bb9fa6130ca5d0738e92fd2
- SHA512 885fbaffd14138ba349cf854f6d4916e16aa5cb6b7b96ba295ebd0b0642952f5094773e21d82e5d43a90a9787aca5d99de680b7734667621ee8253ad7da9e45d
- SSDEEP 196608:2lZvNtczct98ABCguvNz5WeeY2+E4YBbRt3:gvNtczctKAB0Nz59922YBNt3
- TLSH
  T139A67E60F6C38276D45609F15D2DAB7F442CBE6D0B7084D7B2C4BE5EA9349C20E32B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral13 behavioral14
- Target
  TeamViewer_Note.exe
- Size 656KB
- SHA256 c0b1abe249ccaac421bded3d76f3ab4fd89f41a0fbbabfa5e3313d4713e7fcaa
- MD5 5ceee25fa875f1604782bf16a1854a71
- SHA1 d8a31d9706b854ab94b503bced2ede08dc5d18d6
- SHA512 f5a8ea319cee4c563932cd41603848b81669751fc7634287a5df0700c296648b73280003afa06c08106adab41a1f9fe4197289807ca288a5b615cd73a24e1e86
- SSDEEP 6144:rOnkXjbe1FerINZ12VGCn9tIk0pTtjNqLIrjKiJq44w+sYUJdHn:IMPvrgZEVG+92RpNqSjKal3zJdHn
- TLSH
  T105E4C570A582C023D563153DEA65D2F7142BEEF1DBA079E726883E2B3A343C5953981F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral15 behavioral16
- Target
  TeamViewer_Resource_ar.dll
- Size 268KB
- SHA256 ef831aeb6f7f758b1d83398be64f6d9ae921967755eb230d1b2a25341ce821a7
- MD5 9b563256ef29b4e745c9569cee7c560c
- SHA1 583f73baf31486bd2c7e4c3abb42a0f4036e2252
- SHA512 b556bda21fc05ec14142b7bc593b9ef514f90fd5f97f191f0b9bb1699f917245437edc1e88830d9d5352df8ef76e692890f833e6728142a9051fd33a783d323c
- SSDEEP 1536:2B/ntTLQvjEWk71s1RJXiPxVeHNvBrQrrUcW9dTzVHb8dQaQzrgKhsG9QtCqclPE:2hnMAyuw8gOfKhxka+DNJ++l9CplT6Tb
- TLSH
  T16844A7011E9CC23CF4A79738C523C653629D61AADDDD323F86798E281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  TeamViewer_Resource_bg.dll
- Size 313KB
- SHA256 03fd5e3980f270665855c2dc39457e6ea3335ebfb8501de55836fadf610828b4
- MD5 14978451c3c1e35560c758f20af7f518
- SHA1 aa8b8d014b0e15f2755615d503a149605251f5d5
- SHA512 1f66f1472bf5c958738762ecd536a6bac946f23a04dadccf2361661aca904bbbb41950acbf4428959d1d31beb72d7bb05555a2a5d86577326e384e0d5f92d540
- SSDEEP 3072:22EsR942CoRSkuQq9IfI3rd7/372gfu9YyedmpNWRa8aj:J2uSbm
- TLSH
  T11064314FB8BD9240FA59D3311F6686E721BA7B1073395ACA835F7D68602CA3533252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  TeamViewer_Resource_cs.dll
- Size 290KB
- SHA256 768384189faecf5d7acdc639a44568bd9b9930d877afcddecacc59f39423aa22
- MD5 4adbb36733f4350a325f6cad61ea3dd9
- SHA1 51cb26e848ad751a4f116176230a6bfebc9b87a1
- SHA512 dc9bd8309992b0bb0e31f2c5b9c2a27937a74bf7d72fe47f2c42c11220f4aba4fe22ff0c88a269eb0ef65f7895d051dcc88a23fc566dc0b2fc04dd1201d3c4fe
- SSDEEP 3072:2xP5kkR5mEnHqea+1KSdKUNNWP6ZLAjOrJaWg5iCqV/Zw64uWAg/d3RQdesbywmE:SXpjcbCSDK
- TLSH
  T11B54030226FC0685F6F7AF76BDB406624E7B7CA2BB35C14F9550428D1C70AD0A8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_da.dll
- Size 286KB
- SHA256 78e8581db96916e2e8a25167bc8878972c758a8ebaa0fb97a9d8333781007896
- MD5 f96c568c3720b9e9f608717ce3263445
- SHA1 65433abc23e2fdac5b72fb5a020169b739868266
- SHA512 c67735b10f7b1bd7dbe6693e37fd89e24cd61c3cd63c1ca78519d1f43444b956716b2e4a8998d71380de1c2941c03bf07898ec3cdb48a72203e307e7a5c2b539
- SSDEEP 3072:2bYQ9Hp6/P0fCWeZPC/5OOwEy7kS7xRa9xt+/CDI8w6rMuQopVpcG01eFDLBD:bjgO6b
- TLSH
  T10854985123E8520DF6F73B34BDB902945ABABCE6BD39D61D1250518C1CB2BE499B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_de.dll
- Size 323KB
- SHA256 14b3e0e21e4bb22ef61e05b953a1bbc8f8970d44e095e648232b122a56df6c3a
- MD5 bab241a0f4a6fd44fbee95f156fe454a
- SHA1 90984b97efb01e4b685503f10682d132c10dbb0c
- SHA512 9d0550c8d2ca06c01451c2f86d1abb96ed1859c922eb2fb38015a2238df1bd3a9860dffb0addc1f828aca2c69083a3613ef4b019244837598b59bb832e1c1070
- SSDEEP 3072:2isIPtpxZ4Z7lkfDbw1qBK/CuJct/bG2XgzEdHg72c1XLvuBMPKjFRnStnAb7dc8:7VMoIWtfB
- TLSH
  T15C64EB5117E98A18F2F33F74AEB863946E72BCE6FD7AE54D1710509C1871B809A60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_el.dll
- Size 349KB
- SHA256 6ae66b742a7a01eb5144c301da2ce49a690c1bdb6ebc2c75009bcab690c32ddf
- MD5 18bee293ee2c462ec7e41e1184f56948
- SHA1 a1e838d1fad357a2d7b169220db6ef354012d0c8
- SHA512 91a8cb506b687ad3e1b4c5c64e98e4b86efbf4fde4e23ad8d5d7547f3bdc6d54443fd1f4383f7baedd9b0c0a0151ef1fdb89fd8655c5c74c4f8965b9c97245a3
- SSDEEP 3072:2oMm6P+ZktTFK/iRcEKd5isKwl4QINuLn78eoc2kdd2w0hqXyA20GCUdyldow5e0:gbiTxAPNlVnbo1h541bT7yrIvO
- TLSH
  T13974288E0DFF2721DEE999F2583381665AAFF9924428DD7E72F07048E91DC114DC2E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_en.dll
- Size 282KB
- SHA256 b47b62e0c73d5baa4243e171aa910992c2936b0d30b7483bb54e6bc8f00f6051
- MD5 0897ad65996e4db2c0c56bd35541bd6f
- SHA1 8c3470530af67e0a569cbfb20ec0a7f395ab0c8e
- SHA512 3acdd5c5c666b6687c1e601026fd3de7fd4035df819a77804d4ce44209308c579834cfd81f594d232438f80eea99c6b36b44e8c0439655b924d025b30f6d190e
- SSDEEP 3072:2DQG45R4mShz4gSzk+3p4sihmBB7K+xk1NTKXdvd:UA5tVNNm0
- TLSH
  T1DF54995163F94208F6F77F74AEB926644E7ABCA6AD38D29C0250405E59B1F90DCB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_es.dll
- Size 319KB
- SHA256 d88a1170dc9d2017c9be50d4d062befb862d9dd35ab2a1c6513f724b0bb7171f
- MD5 07378f4903a72b471db3855a9dfb79ae
- SHA1 658bc75d3c2e6327038735507734c85013ba24aa
- SHA512 929200725fddb4378c4b04dcb2d0f0b24d010822dd630917dfc1c3811599cbc8cbc8ee4f7d419d1dda5ef9f1f6c39c25ff006ccf68c3612dd5d7ef0e46df24d2
- SSDEEP 6144:XVbkh6PpGmXLRjrs8zsSHhryjGK73qKhDdPy:n
- TLSH
  T1E864425067FD6246F6F37F29A97916698E3ABD92EC38C14C4220525E0DB0F84DE64B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32