618cf871f4836b4b53e2cf8a8c46d6d3313631528794beec0740fdb73d8f53d0

Sharing

Copy URL Twitter E-mail

General

Target
TeamViewer.exe
Size 15.2MB
Sample260804-pg8hzsem41
SHA256 618cf871f4836b4b53e2cf8a8c46d6d3313631528794beec0740fdb73d8f53d0
MD5 22c15243df7db4e59f7204edb7a28ca3
SHA1 7aad802551e9cd1e930fa43d7368c3f7f765b715
SHA512 64678e984d66710a73f6a35cbd98902c6ebfe2c1aa6dd59248ea14e11b50c7614c786e0c27f0714167e443cea8cceca7ce2688432309a844b0658603b836a69a
SSDEEP 196608:hziOmjpRS0UZQPfLyHDIJXwCxnlOY2ghEQsbapSaqk6qF60rIyo5hNnHhpifyGZi:hzINAZ98R79hEQsmfqkdfrs5hNHqfWOA
TLSH
T191F633E9D7F286D7F8325E34D3925A7464323EC9A8E52DF515C8B72C4A301DED20A86C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  TeamViewer.exe
- Size 15.2MB
- SHA256 618cf871f4836b4b53e2cf8a8c46d6d3313631528794beec0740fdb73d8f53d0
- MD5 22c15243df7db4e59f7204edb7a28ca3
- SHA1 7aad802551e9cd1e930fa43d7368c3f7f765b715
- SHA512 64678e984d66710a73f6a35cbd98902c6ebfe2c1aa6dd59248ea14e11b50c7614c786e0c27f0714167e443cea8cceca7ce2688432309a844b0658603b836a69a
- SSDEEP 196608:hziOmjpRS0UZQPfLyHDIJXwCxnlOY2ghEQsbapSaqk6qF60rIyo5hNnHhpifyGZi:hzINAZ98R79hEQsmfqkdfrs5hNHqfWOA
- TLSH
  T191F633E9D7F286D7F8325E34D3925A7464323EC9A8E52DF515C8B72C4A301DED20A86C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
- MD5 033ee34c40e8fa85bf2739bcb2f3e186
- SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
- SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
- SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
- TLSH
  T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- TLSH
  T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 210KB
- SHA256 c67cbd5e35e1ce0c7ba17c55d8e2bc33afd5e0a68774554a1fe7216d330c709e
- MD5 05f51bc8ffb2c8f5a2825bf5680301cf
- SHA1 30f7f77dce1fb3526142780e9f5bd5c11622d6b6
- SHA512 1e041aaa37dd00414ad955ebc8c0f708589014d2085a5a0b95a31f4d694bb1cc4994bb1324d4b983cbad0449fb0a05560d82c60fdbfc78be67ff61275e451233
- SSDEEP 3072:4J7KJkcma0VkpOG/374vnriZ1nmTaK405/+ncMCQ2bDh:6EkcmYOG/37MnGZoeKxpuuQ
- TLSH
  T1D7245B0177E4843AF2F726746DF6C6604EBDBC725934D18FE780892A2E70A85DB24727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  TeamViewer.exe
- Size 32.4MB
- SHA256 23ad1b0af1badc4bf855f0caa63fb914ac9d4358a1f0a2cf094a23b263e66777
- MD5 c3a158d69dd236d9da8a0733cc1f93b2
- SHA1 7a96ff4c7b27d823e959161b2bbe04d53969d907
- SHA512 45ffe1e2e4de546e3839b127345b9a01417891aac0af42d6ba0d8c3b21e4edf9cb3e88e8f3b583692f55f79009e8af1b565d71ff65e6fd4960134e09d525001a
- SSDEEP 786432:nzGtIzLtJS10nB4gkrmLu7wgcgGflCC3pM:CtIzLt01OB/5u7wgc/l0
- TLSH
  T162776D71BA85865AF59241F25F3D5B1F8B1CBE09077441DB62E8BA7E2C344C30A32E76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral11 behavioral12
- Target
  TeamViewer_Desktop.exe
- Size 9.4MB
- SHA256 19d2060099be05207e3ef491f3e42a273d502aede40db345833a7eb5d2594dbf
- MD5 9ee06bb9cb3643c50ccc699680917aa1
- SHA1 cdfb7cac96a491aac965625c4f18843a9e6d6662
- SHA512 311187a4a9115975c1d9ef884c1c55dcc79e748d2ab0656579c187f167eedeb06e90ae5cd1a46e52d12c6f198706c9da87da647a5d2a1c8c629b81509888e854
- SSDEEP 196608:o1EJTtczctrUDQGHh5CPyyJErbS5EmgFO:/JTtczctrUDVmzubwEmgw
- TLSH
  T183A68F70F6C38567E45615F0893EA76F402C7E5A0B2080D7A2D8BE5DA875BC31B32F66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer_Note.exe
- Size 662KB
- SHA256 a4a5a82d67befeb71504c4f7ffe6f94c25300666f1c5434aa2d2f3b38ea31ef3
- MD5 99a335140cd26250425b977a21b63f16
- SHA1 53d74fbbb56148031f1d2717c110b6d8628a26b9
- SHA512 ce1f2bbaec9d95fa1559177af3b3d5ba0d1cd18781778bed7e46cfe7b305c5d7bb88c8b95eb78876b63513f0ab9f1eb16814a780f7c49ce95cb16cbfc7a892fd
- SSDEEP 6144:nDP34V0zhw3O8RGLX7dOLgxuaT8A9CLTRwdSBUYyrDD:734Kw3O8ILXRckZwAQ3RwGOrDD
- TLSH
  T1D3E4D570A582C123D423153DEA64D6F7142BEDF0DBA079E726883E2B7A343C5953992F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  TeamViewer_Resource_ar.dll
- Size 269KB
- SHA256 2ee605e650fcdd8a48e05ed6d816093b22e95d050aefbb9e55607f7b62b736b2
- MD5 6c17582a2f41de4d55c2485a6a041833
- SHA1 e419b3e8630be56f5a3660457b57e8edba1662ed
- SHA512 2d0e9525dfff9d2035eb471322e475223b59e22229f9dbd82f4815be5ce663a56761851f47d6e1a22f76f8db92b663945a804311bacfa0372ddf4f7582489ebf
- SSDEEP 1536:ozIs6nLQ8NR1ODn1J1R/kiPoV8H9v07QJfUcWtdTzVHb8WQaQzrThsGwQt1qMlPx:3saiT2zsSDE0EkhzDNJ+0lff47a61UO
- TLSH
  T11A4498011E9CC27CF4A79738C523C65362AD61AADDDD323F46788E281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  TeamViewer_Resource_bg.dll
- Size 314KB
- SHA256 c0e8ed54991f15b87cc344d8a91bd2fb4db64847034652a2fb6521b6a77668c9
- MD5 55f7fc65d78c8b13fcb20696cd2603a7
- SHA1 084935c41fc3d4db0a8f5c7b049d21c8027b1feb
- SHA512 bc087033ae979174630899dae9887d6c70560146af003283f29c5aa710f5424eec1403314528a0f26d236b56559379d2789e9216502c38a6ec012435bd21ec37
- SSDEEP 3072:jZPw9b2CoazFmFyaFprQ7q37ckWE5yeDypebRagXGp:jAkZWp
- TLSH
  T11864414FB9BD9240FA59D3311F6686E721BA7B1073395ACA834F7D68602CA3533252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  TeamViewer_Resource_cs.dll
- Size 292KB
- SHA256 e07f852b43a70ccace2c8f7280ba04dd7af5a088cc95ddb62f1973ed91e90ef1
- MD5 a676fc27d5257ea4ab3fbf7dd088122d
- SHA1 2a7e8d169485c238c40a5e2a8dd8670099bb8057
- SHA512 8638a42cb7bb62c8999266e8a40c52f05a47f5ba936a7000cd51938099e41bba63f310a128d3f0f29e20d1b9761f6892e1ea83028121aff2998b1439e81d711a
- SSDEEP 3072:nNlCkkXBmEnHqba+1DUevFNWP6ZLKjOrZaWg5iCHVkZwj4lCAwAX3+QdesbywmBO:nNK35FCVTysrd
- TLSH
  T18654F20122FC0685F6FBAF76BDB406624E7B3CA2BB35C14F9550429D1D70AD0A8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_da.dll
- Size 288KB
- SHA256 11db41daf31427ff233304899ffb78785eea0dc56b51732415f9461e5bba61be
- MD5 de32cccf9653d96705961b4a5b779059
- SHA1 56f4a2cea9ecf3325773a5780d757742c15db8cb
- SHA512 7a3ff9c2989a647377a2e7e2d2945441652cc7291e6c0ed4f2659f0f6570ee43811f103821d2f3bbbd77a60605eb654bca670333b030fdc22812e2298e373b2d
- SSDEEP 3072:Lqj9b0p6pP0f5WpZrCF5OOZgI7R7cRa9x/1+/CDT/o6bsSQokaicG0geGDLHzM:+dgy62M
- TLSH
  T14754985163E8520DF6F73B34BDB902945ABABCD6AE39D61D1210518C1CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_de.dll
- Size 325KB
- SHA256 61c27e8134b0f34d558503ba02a5d5cdf5683e1ef78b9c1401f5d118d746b7e4
- MD5 94a8117645ff6745f957124ee9e37edd
- SHA1 e7a8f7ca35f172d24c39f3b2235f3afde36b24a4
- SHA512 284181fa64b1f4252e4acd1d69afa3da6c6a27cf6a95989a00f14c18b44b5a9f6d5cf4a10e71ce32b59679333a0ca9453eca67f63527a7d59c0af2a59914b067
- SSDEEP 3072:OuPbSsz4Zbl/vPDbrlqpISCuJqtDbKYXQzEdNyJ271B9Ru/MPKj1RnStnNZdcvmD:Iz9b1tl3T
- TLSH
  T18F64EB2157E98A18F2F37F34AEB863946E72BCE6FD79E54D1710509C1871A80DA60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_el.dll
- Size 350KB
- SHA256 74af25eacaa7a1264a1146da9cd041cef80161a2c8d31d01fca50e5ba74a9635
- MD5 ec71befb9de16e531ca8da18a66aa30c
- SHA1 4ef2ab34c5b28e6c9ec4120b5a74ffb384661cf1
- SHA512 0fa777441dc8f42ea095b2534dc6cd5413dce0a467f7143c682d007301af378fefc5956b7f65527dc6caea102723df2b2ec30eea4385df90b62da71fe0f27673
- SSDEEP 3072:l2y6P+ZkvTwK/VVJEKd5iNKFl4oINzmF78+oc2kdd2w+AGXUoukGCUOqldoweeyl:qdbWFAPNlVmb+GF54hFTAxaLVWH
- TLSH
  T14F74288E0DFF2711DEAA99F2583381665BAFF9924428DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_en.dll
- Size 284KB
- SHA256 b4060107525f7ff66d0d3f4f0defaa792ecf33153c58e7742fbe2596f1fabbcc
- MD5 1017f9bbeca24ff1da599b671c35ae49
- SHA1 b27f0346af06564ebdcfc9cf23021896c9115ff2
- SHA512 3ddb35f097d0939ddf4960d3fcaf755ea2d8250708301583c9a10a2f3e1d774f963cf1dc06224e759e9bc6d0800a8c3c41e13bb02edb59f846012cf52f3350ca
- SSDEEP 3072:Qm55U7SljACSZEs3t4siBmBB7fvEkTvWKDdffQ:X50lN0ATQ
- TLSH
  T1CB54985163F94608F6FB7F74AEB926644E7ABC96AD38C29C0250405E59B1F90DCB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_es.dll
- Size 321KB
- SHA256 727fdb37eeb29a8160c4f0c2d61edbe2286a9026142a0318a245385535864e88
- MD5 183c01cb08aacfc29baa9300a92d96d3
- SHA1 ef9970c45a379f38e9045a971c3315065f9ba7fa
- SHA512 98f7ba4bd02d20b00c600db7344e1ca54dc6cb7470d219792bc385b4e021db3f503db09f85ef2535a29a35fa2f3e835d7a28514c779e61c85448fb3818372201
- SSDEEP 6144:crNlh6ijvdHNNjtsy1SSW9oyoOq7b8KhUdAyF:3F
- TLSH
  T18A64425067FD6246F6F37F39A97916258E3ABD92EC38C14D4220525E0DB0E84DEA4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32