60e327e01119b749ee432160adb6f4592ee17f013d9471676ea1d4115dd9e3dd

Sharing

Copy URL Twitter E-mail

General

Target
tv.exe
Size 29.7MB
Sample260805-apavcs1ydt
SHA256 60e327e01119b749ee432160adb6f4592ee17f013d9471676ea1d4115dd9e3dd
MD5 065fa0d4454308ee29c4fadaf91a4577
SHA1 d6ed467e595cc84749d4a3c83b1e3bf1405deda6
SHA512 289858e1dbb93b349c9a40319e8eb37906e523e2342839bab9aff562fd7a13e1a94e0253f102a902b0dc7bea8fead64d260b4f8a5a93dd49cf767af879c28c8a
SSDEEP 786432:IKtF+ZjRPA9oSmlJNLheHsE6cnrqR2nzG5KUobfly49bJfJ/mKb:Im+ZdPnJoZ6qO0G5rohR9bJheU
TLSH
T1056733F82EC1156FC5227EB3BD28642FF0119F163AB0610D385A7854EBB972E9DD9708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  tv.exe
- Size 29.7MB
- SHA256 60e327e01119b749ee432160adb6f4592ee17f013d9471676ea1d4115dd9e3dd
- MD5 065fa0d4454308ee29c4fadaf91a4577
- SHA1 d6ed467e595cc84749d4a3c83b1e3bf1405deda6
- SHA512 289858e1dbb93b349c9a40319e8eb37906e523e2342839bab9aff562fd7a13e1a94e0253f102a902b0dc7bea8fead64d260b4f8a5a93dd49cf767af879c28c8a
- SSDEEP 786432:IKtF+ZjRPA9oSmlJNLheHsE6cnrqR2nzG5KUobfly49bJfJ/mKb:Im+ZdPnJoZ6qO0G5rohR9bJheU
- TLSH
  T1056733F82EC1156FC5227EB3BD28642FF0119F163AB0610D385A7854EBB972E9DD9708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 1.1MB
- SHA256 6428451d60cb29e9a8a3e1fe60d92819ad6861634128e5dd4492086be40001de
- MD5 730ca4cb5f0906df655ad9d8e7c50bb1
- SHA1 f806ccb294670e0a577c6d42ce2b837d1069344a
- SHA512 832b959b3bad146193c7c68b68ca54d06a5f3860a9c3c54f02484663774f029714b3ed6536c422a8b8f69d4b8092604584983c3fb99d52e025b561abe8d17bae
- SSDEEP 24576:19b0VwvSBZ94iKq0CW+lTt41d6fWZ8flP/KMc9xKh:nWwqBZgCW+lTmX6fI8IMExKh
- TLSH
  T1E8355B227511C036E98A12F16D3DEFEE869C6D340BB594C7A7C43EAA99304C37B35693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 30KB
- SHA256 018cba12efaab3ec61cfa2c54772f0e070452d57f2fc71026826fd7e3f59bd39
- MD5 bcb13343ab422d2c7ce98e324bd02c8b
- SHA1 b6e633426c0d9f3d1f2ef0cf4a27218974da1f7f
- SHA512 dfa02415b6c2003eae5b19f49726536d023bf72dc1e4f123906c1e2fe6200473db8e674e94947f6e07f8cda9e0bbe28cab968225968ee832b8e4bfc5997240b7
- SSDEEP 768:V3wCtynHJAIl0CU4K7yAB8tpVdDQJNILw7/YiW+LZPxWEJY:ttypAY0WqVB8tpVdDQJNI07/7LPxA
- TLSH
  T182D26A66897048B1F97788B4B1E03E232A7DFD0258A0D5E713EB86055A603437B7E73B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 61.4MB
- SHA256 04fa329ae379641441186d8ac72e0fb5d483d5033a8c2238911ec177fd996e20
- MD5 1d2be78ef1e39039de1b5bc4c08485db
- SHA1 580a5c7c070e2fe256806ab6a73871a76b7ba318
- SHA512 3d72f0aeffd5ae21a89b299d1d560acb5838829c0c4cbd7ae602fb23b4a4978be1c4214de715815725bc260c2753182a6db6946016b88937782071bda9ef22b0
- SSDEEP 1572864:PlaXwrt74hjKLMha7HhuiqVMMxJvPHZNaw+kw4IATpbzJlruAeE07gAPRTnzx:eRwBxn
- TLSH
  T132E76D20B1C58325DCD741F1E52C57AAD52C9F320724B4CF92E4EA6D6D614C3AA3AFE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 13.0MB
- SHA256 cbf770eefdb24556b54ad276877de37bc546080c7da6580f51d04d00c7924e84
- MD5 4b7827aefb697e132e711ed832628b83
- SHA1 378b741f2aaa280abeff7591e48b0c2820f7dcca
- SHA512 f74149f9d56c15358302c08b6f43f5eb6eed164c6a8a3fa8230f4948ac59b437193c52d4fecd3eca9a6f337ba4c0583f292a29e03ec85a7f5a4edaeca5c329d6
- SSDEEP 196608:9u721KX5AGLxoNjbYWU8965/RRdOd6ChUl2VFVKG:cw1Fg5mnhNU
- TLSH
  T1A3D69F60F1868131D18601B5CD3DABBB862CFE2907A394D792D4ED19A970ED23F32B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 567KB
- SHA256 05a771936ae8add213222a31942203aad9932c4542cc0c9bca70724a461c6681
- MD5 42bdc168418c72fbb2396bd82786ca70
- SHA1 cc7edca45edad00f4d712585a0d2ae5b80b2ef33
- SHA512 7f5e5d51724deef0e9d6dec305e863fd57727bded289a54e3cea33a4ce1d2fde48c146e91b13445b1efefd0be0c16090953a4cc4c123ed8a9e565093368ce870
- SSDEEP 6144:LgGlQCOIFn70MnecE0ThOjugEAuL4vq1jTphQfjIR:LH97PecE0AEAlqFTb2jIR
- TLSH
  T1A6C4F4707C99C423D5528CB1FA2986FFD529AC21FB5854CB7EC43E6AB534380BE32A15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 365KB
- SHA256 028d1eb5fbc127fcaae2fbdf82d0288c77bf6dba9ea461345288a93d31aa50fd
- MD5 3b46efb1c49b266a3d0680c10bb19a6e
- SHA1 255261f11f01334220ee32a4f22d6cec62ad3ecf
- SHA512 7f310dbdef2aafd556f0d15a3c44b49bcb95247fdde8f57e29fcaec14b928d0c1cd63a79bf8a57147950502a02114e45ec40d2f03695cf56fd81d831ef51dc66
- SSDEEP 3072:2E+B9xTDhh/u1LPROk+sU/ZnJxy3YlmBdVLv99lF64Ol//:2hxTzu1FghodV59lF6/
- TLSH
  T15B84BA011E9CC23CF4A7A738C523C653526E656ADDED723F47388A281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 429KB
- SHA256 e8715d2bdf15b9135e03375644f0dfbd08b4587a64d98f09b5f54645eea46090
- MD5 6289765139b27559fc1cbd7e7abe161c
- SHA1 eeb84c6c20555c77090bfcddd0fa32ec6bfe342d
- SHA512 57eaac4eb42ca2bb8a881cd47aa9783e877dd092ca62fed2fbfc3b3bdfd098850a3c91f83d55af538f09ec18c422df7638782c0f16608c39559c59a90bf33a0d
- SSDEEP 3072:5mBjFn5PqZ9ysPeDZpRgBr+9ibYoypIO/NSkxhdQpSZtrRa9W+97Tfm2/F:5znYrUSSk29
- TLSH
  T18294420FB9BD9240FA69D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 400KB
- SHA256 f524c584898e9e40d19d266e61256c978d0e862b6b2937ceb7d71ac06444498b
- MD5 78c815ad9c3cf916f9dc8384d82b3677
- SHA1 2983b9704e4fca147d26dbc1fbc86813161e6139
- SHA512 1a70f3a50f35caaa6abeab1046daf5409f1f33446628260c05fa4a526d31324d980b900540ee98fd84ac5396b6536dbfeae68eae366f2926aa03fe23d9ef79f0
- SSDEEP 3072:dh6kkALenmGn5ea0slL/LbDWsQOBY3KBtQA3LP6ZLRxjMaWg5iCFAVgZCx1zoUPy:duGE2MSi/C1RHvqUc7Vrbt26/4R
- TLSH
  T16D94F30122FC0685F6F7AF76ADB406624E7B7CA2BE35C24F9550429D1D70AC0E8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 394KB
- SHA256 ff7c767ab025ce6a6146371b63dbf36f32c65d0b192eee2539ac884e575386fe
- MD5 bf784dae47f4f5758ebe4bf7fac93295
- SHA1 dec528bc3579cb39e84855b6d3611b5df6db8a96
- SHA512 c4d85d48dbc0e9881a3476efad42740ec2f1e4b351c5993fb2f6dea8e76da0b5030c4c49610e188b1c71a0914d1b9113a1fa646c6c9c6495c15d94d23302067b
- SSDEEP 3072:AuxpskWpUSPql7P07PRWIZO5Cv5OL1MOmnc007JGDzM0+/CDxdjU+fR/k1c/wNc:A+HzAsN+6
- TLSH
  T1BE84965123E9560DF6F72F34BDB902945ABABCDAAD39D21D1210509D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 441KB
- SHA256 4b64cc1c4d3c42a2202d036d446a76e2e85a31509d7c14447556ecd100251280
- MD5 c0ae7d68ae3d9df7a05dab67c391f001
- SHA1 0ba8645f891b880a77153a690f68924e7e3d07f7
- SHA512 a8d45a0842e0249c0d790ee1358dc47b728ea84f2c32e9fd98dda0ade6f21345c36701eb69979622e44fc70002216f7a6c6103c318233196da92e61378d4f56d
- SSDEEP 3072:W52PM1HDB74Zp0Fk0k0C0spiVCuuY15XyzTFPT8y1OWZ15Afx9quxM8lsKjSCNPZ:W0SzeDWtTBlUwQ8
- TLSH
  T178A4EB2157E98618F2F37F34AEB862946EB2BCE6FD79E54D1710509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 468KB
- SHA256 a8ad00544126ee56d7a21a983a6ddd120672511e1052a1cde766b653cc531ee3
- MD5 5d483baba6bae87bbc4aeb17d360ee13
- SHA1 2323c3bdb2ec6301f8bf01a488aaf4059ca7a9c9
- SHA512 abd52328acbdf3e1bcab2ae9acd247662573c27a0a1e2a26ef853903fedc7cdda5ae519e4bc081e30cbd45781dcfeefd884669c45506e0344ce30a0f2abff912
- SSDEEP 3072:felY5zZk1SKMw86TFnb1Kpl4nXIN5Gt5F78zocrJkdd2wdfafa+TAXpyg+CUOPlQ:fWTngAD9XPNdVaMpaqdcBGZJepqvmiNk
- TLSH
  T170A4278D0DFF2711EEEAA9F2583341565AAFF9924828DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32