5a72cd6f1d7a06a50867e2524b88066fd000b97d7001ac9346990adc635bdf14

Sharing

Copy URL Twitter E-mail

General

Target
TeamViewer.exe
Size 9.2MB
Sample260809-pjmpasxfjb
SHA256 5a72cd6f1d7a06a50867e2524b88066fd000b97d7001ac9346990adc635bdf14
MD5 ec451d8e7ca456a9d5f466548c7b0f6c
SHA1 c07b6cdca4dc3b28940e61755c13e468d248078f
SHA512 f8d9017d6dc818dd3ba652629b18cb2d01076f150e99b11cbdf2804d2d2f8c18ccf2902a43ea65a2b675574cb19650486d083ca21f4af7e6567b31dccf4e921a
SSDEEP 196608:NjVUuOMTvDD2w1sLYY3bjJ3IvtHamV6ClLg2W8mm5fE63Z:FVt1tsLYY/St6mkMLg2xj5tZ
TLSH
T1F7A623AD97E35387F8321D3ADB52963454363EC164E82DF54688BB2C4E302DE931B92D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  TeamViewer.exe
- Size 9.2MB
- SHA256 5a72cd6f1d7a06a50867e2524b88066fd000b97d7001ac9346990adc635bdf14
- MD5 ec451d8e7ca456a9d5f466548c7b0f6c
- SHA1 c07b6cdca4dc3b28940e61755c13e468d248078f
- SHA512 f8d9017d6dc818dd3ba652629b18cb2d01076f150e99b11cbdf2804d2d2f8c18ccf2902a43ea65a2b675574cb19650486d083ca21f4af7e6567b31dccf4e921a
- SSDEEP 196608:NjVUuOMTvDD2w1sLYY3bjJ3IvtHamV6ClLg2W8mm5fE63Z:FVt1tsLYY/St6mkMLg2xj5tZ
- TLSH
  T1F7A623AD97E35387F8321D3ADB52963454363EC164E82DF54688BB2C4E302DE931B92D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
- MD5 033ee34c40e8fa85bf2739bcb2f3e186
- SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
- SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
- SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
- TLSH
  T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- TLSH
  T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 154KB
- SHA256 f89a02e858183d373d35dfffc21359acf3d45eb96f8206c3581ba05ce49d2023
- MD5 b1c0c4b14c3b6787ab1e1e4f91579c4a
- SHA1 f099b16e9e33decafee22da17574771968565c58
- SHA512 76718483b8f07704409a69b9a4613e9fc48fad0dc0b9dd9f435e44d1f174dce6ae8eec56c94e24b0a289aa78c5421e2258f977c12182e1422570fd33f1cf463b
- SSDEEP 1536:VngJZsOHXEFxQplfzbTJ7nKdgw5TLTKbZYVo+vwCgQCQKDnjBhEKiuqX2sE2OGWl:Vg/sO0ghLQMp+GQCQ61sE3GWYy
- TLSH
  T17EF3191133F08035F5F72A78ACF4C6608E7ABD32AA34D14EE750C96A2970B85DA75727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  TeamViewer.exe
- Size 26.7MB
- SHA256 df128d2bed4b62e1b51fcde808cd0fb25561440684eb51bfe85729c6017a5b5d
- MD5 0845a0c0ad188ece8d013174ea2e16d9
- SHA1 c5674d149d4408e369da52cd7a88a96a9c8256f5
- SHA512 dd65ea134d47aa16548aebba606f0ca9be5f9f72811ca1675bf1560cafa7780ce11c3fd66874eb3a32ebb02666a4c84d9abc09bbd077bbb6eab053aaf3adec2f
- SSDEEP 393216:YctdzFtUZ3SvumCjdyIzY4mw8pGrnYIEI7AG8bV6KqEuzJWR8awqgTzwg+h8pALC:YctdzFta3VpHYBpGTmh8IgXN
- TLSH
  T1E9573B10EB97C1E3DB6311B01276DB1D87799D881B684EE3D6087E2E5C316C1BE3B1A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral11 behavioral12
- Target
  TeamViewer_Desktop.exe
- Size 8.5MB
- SHA256 08ae7e2e41f7a76305e621a6ea561a8302376f36dcc8bb67e07813694e878b17
- MD5 9448159d6da7b048f75da260cd92b46c
- SHA1 52ff7fa4dea1297e78aae7a58e16cbb81d862411
- SHA512 0071262c2104eae60a551f5c163a4096a833c4b7d63321551cb66213acf8cd9e02e0d60163cc6c52b07f8f9f36de8b1db0a277ebd998a85bb5a6f2fbf21e580c
- SSDEEP 98304:h5dueGctixzy7t6rlHdC4Mq510r7rUkh09AovRDUPxPjoS34DsYUt59e3W:h5duktczcteE/Ukh0rvRoPxP/34Dsq3W
- TLSH
  T1D1965A80FBD3C1F7ED5301702536AB1E8575AE885B249AE3D3983E1E99312C17E37299
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral13 behavioral14
- Target
  TeamViewer_Note.exe
- Size 188KB
- SHA256 e6cd8cd5a2cdc68f51225790fb611137d5e2166213d9cd24a1fcc3e31b90e9f7
- MD5 6167289a8de15cc4a0147a9b0985c7a6
- SHA1 1914a56e5ae440533bf837f6bbe31e4eda4ca3d6
- SHA512 97e3766f39b239988669beba70f8e0a9f61c6f422be8aaa7e7efdc1fffa80fcfb230d3e7eeffbff3bb1617a7b7e9d6b0bd3d46d9acbbd49b98702bbfd615be8e
- SSDEEP 3072:Rps9BQ8cAqdMP+RL+yiimZ9qUkiZAmV4WbV8vp/uDdOR11xC:mBQ8xB+L+yUCYV4WZMcDdCLC
- TLSH
  T13714AE1176C0C071E8A6423288B8AFF3557DFD728B7019DBB3C43A5E69755D01A3ABA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral15 behavioral16
- Target
  TeamViewer_Resource_pl.dll
- Size 650KB
- SHA256 eeaff063bc5483bfe1dbc0d248ff6eded799be4b7556b2e59103d8179baa90f9
- MD5 4f7b9f47d8e2a0175e2ba468ad453706
- SHA1 18770d0fd055b0aca5856e1a5a1dd3403f4dbe7d
- SHA512 b5adc00f72a15cfac1b7562910807d9e3f63bec0eaf5dc8bde3b1a8813f295f65321644eff4d0297d9d0cd0540091949cd7a217770ad0e0de2f3ebc499b7ba1b
- SSDEEP 3072:v079NYVUTMDZi5GfqPpt5aODeWy9vZA6UOEtB/djMP9P8BPV3jfT7Yfo8O+11:sDMDZidPpmVxPB8A9OG1
- TLSH
  T1C4E4DC5063F90297F5F36F34DAB522A44A3B7DE2B9B489EE1540720C09706D8DA25B3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  TeamViewer_Service.exe
- Size 7.8MB
- SHA256 cb352f4c852de75c3f2bbfb3a7b9412687cacee2cb18a3f20c6b4f6dc90baf4c
- MD5 a3e61244246bba5d12bd241aa44dd33b
- SHA1 0a4cb412a21722e0ff8a432ad3fe6dc3f0ab560f
- SHA512 fc95f0d26e0b5d0afe8f4b55014796eca779119cce5d1e303ff07406731ea220bdfe6b1ea9f870bf5bdfa738cee6602584c6480d4f613ad93d993a072fd06b9d
- SSDEEP 98304:m6CpGbLzIHSYLxRJa/LhleKF8HA9Kzbg2+WmY8+S:wGvz6Swa/LXiHEibgbZd
- TLSH
  T1F5862B00FB97C1B2EE5315B02676D75DC47AAD841B345FE7C2483E2E99306C1B93B2A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  TeamViewer_StaticRes.dll
- Size 1.3MB
- SHA256 c917e01bfa61d9f98fb21a4fd416a27c0dd1e063cff711bed9b23339f6ae3556
- MD5 b8fa15355c889d14dff87fa723c336e1
- SHA1 ff33f4fab283d9ba75088c755931ecc49223e640
- SHA512 9fda6621e50d72290b14671f78b7f634234321ddb8bf9cad27f3bef88eedb18ac07a6c431143fe2c39e1d719cd2b5efff79556482688f554aeb81a556d00d0ff
- SSDEEP 24576:gxKYX3aB3IZCG6qVeSVms1oyQWdaqevJ+eb7Ll:MnaIBLGyHeh+eZ
- TLSH
  T1A755CFD3EEA1ACA5D44E613385DC4800DDA39DD7BE221A1FBA8DB86D4F313885EC1647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  tv_w32.dll
- Size 244KB
- SHA256 66f1a2040a1fe4e08e3354db8ca896d123d6ada86d8885ce75b2d3128e5aafab
- MD5 7a41da04d8845f15d45a48ee41456ff0
- SHA1 05a367a773891015fa5c79758e0c5acd0dbfe92f
- SHA512 06422cac12efe9d92b79824265f7f763d996234fc144ffed52f8d7f00c3a2928ec61fcaa21f44e1de73b1f2e603826ddcf46505c6b37d12621eb4761d7a16da2
- SSDEEP 3072:7WET2auTvFxV7KE5yHgMNH9V4pu9YyThfQkog2DEciSsrL7Mz0njVDs+:7WET2auHMNP4ofY9gZGUFs+
- TLSH
  T1E3347D017587C930E0B3027A5528FB920A7E7EB64B35A8CF67E529BD49744C076B9B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  tv_w32.exe
- Size 243KB
- SHA256 40535e5d76eaec277089c24578925bdf8efd42e0be015285cce4897f41eedb05
- MD5 b2e31add16c2e3e8408330443839c1fd
- SHA1 2ba56ea53c3b1fb544e5cb6dc3fbe94c9c24a57b
- SHA512 1fd8a838bc14a6bff6d097c0d1ee05bea59be242dc78dd9ce68d54bc503d6e7dc5af3ee570df904b027caa1dd83a5b6ea5d784e525bfab6a75e1b815dadc8b71
- SSDEEP 3072:C9StClW7Bn2MDna3x9EcjmBwJGwrL+kSxYOh/uIeh70gHip86QAgvKYP8G:C9StrIVnr6kL+JCqD1pgvKYP8G
- TLSH
  T1D5349D017B91C032E57302B74AAA9B26057CFC224B765AD7E7D80F0EDA346D1A736727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  tv_x64.dll
- Size 267KB
- SHA256 8d6c45de7afc008ad2bac1a0ab364c21844f5aefd23ec7562f46c445243a3178
- MD5 3c09a063e09c15d85d286c6787fcc982
- SHA1 197fa541b14bda5aeeaf16bc058fc78864002dae
- SHA512 2f3501b2455a0e189864e34c8e30e625a44f7233195685d32d273dc30c12c94d9e63d18bcec07f49aa1c4ff71052fc9e9f4465ec7ed258fed04f25bc87d8bf6e
- SSDEEP 3072:Lu6mJ+i7pFk1pQTcZVywO74hN7TjTgUZTPkzQ4+aQ1XhqhfCd7uVH8oMJpK+dIUQ:vK+sSfQoZVyynT9Z4zV+pZhq2yusqQ
- TLSH
  T113444B55B3910CFAE8639239C963D641DA727C520371E7CF03E492A91E336D1BA3DB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  tv_x64.exe
- Size 280KB
- SHA256 02348a9bcfd2ee3b07a4fcd4575b3774f777ec9c01cc674aeaae113a87d1e02f
- MD5 fc1ec1e1f5b894f21f994563ee0deb5c
- SHA1 9afa1cb08f46611c0bffda15eecda1e148ef24a6
- SHA512 2b1146ebe451f49169281972daa8d617c3f73a51c79063b345d55989582b8c33f80105d4697a177ddcd4465224c502e125e779b79788beb7dfb9e99923673a6d
- SSDEEP 6144:Uh8xauaWN2e86lr0RL2TVX+QxUL3zruMA4Nx:g8Aufb86loLOSuy
- TLSH
  T1BE544A0932A40CF5DD67C23D8D928542E7B2B85A4771D7DF13A4029E5F37AE09E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  uninstall.exe
- Size 408KB
- SHA256 b7e7d2f2e1cd2d519183cb173aca882ff735114cbe6c1120cdb73e93364743f5
- MD5 7fb082f0c4f42ee21681ac897fdf6b36
- SHA1 67f83a1e7bf89eec76e0c83f80137e58be1790de
- SHA512 fb4917d6694cc500b49ece56647dc895fdb22602f446a7fab504dbf0ba6cee112080767a278b884cfc12cbf76b3ecc5a4b11382a4a68965ebc8ca54946cd385b
- SSDEEP 3072:0Ae+3aJpqWXTBum5GfqP/bbIa8h3Q7IO1r/ImdOiXFA+/xarG3bF/:nB+pqUFdPT9h7jum2+/xcGB/
- TLSH
  T1C99463E9D7E356D3F8326E36CB91523460323EC9A4E46DF556C8B72C49301DEA21E92C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Reads user/profile data of web browsers

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32