93d7d57e3f7a768cd004112c85cc2f5d448405572ec6e62f3b54c15ff9b32e7e

Sharing

Copy URL Twitter E-mail

General

Target
POMOC.exe
Size 28.3MB
Sample260810-agzhradb28
SHA256 93d7d57e3f7a768cd004112c85cc2f5d448405572ec6e62f3b54c15ff9b32e7e
MD5 690bce0faeac06043a1cac829ee2055a
SHA1 75142af9d9a9a248634875418834f136ff324d76
SHA512 a3aa489803addcac4d2adea15dd7ca397f6c846ee1642bb092637c0f3881e1db629972264422ae669f43106a2500950178c693e66ac6df899144ebc656cd912d
SSDEEP 786432:7ROfjaYN/Q1ffrLUA2FGmlMQHN3V+1AoU7:eaYN/QdH/2FTWEhViAoc
TLSH
T13A573330BF9753C7D43A8EB23916466BC1896D09BFB2406F9F64767B243B7E1D88A104
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  POMOC.exe
- Size 28.3MB
- SHA256 93d7d57e3f7a768cd004112c85cc2f5d448405572ec6e62f3b54c15ff9b32e7e
- MD5 690bce0faeac06043a1cac829ee2055a
- SHA1 75142af9d9a9a248634875418834f136ff324d76
- SHA512 a3aa489803addcac4d2adea15dd7ca397f6c846ee1642bb092637c0f3881e1db629972264422ae669f43106a2500950178c693e66ac6df899144ebc656cd912d
- SSDEEP 786432:7ROfjaYN/Q1ffrLUA2FGmlMQHN3V+1AoU7:eaYN/QdH/2FTWEhViAoc
- TLSH
  T13A573330BF9753C7D43A8EB23916466BC1896D09BFB2406F9F64767B243B7E1D88A104
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 1001KB
- SHA256 3053b06883b8bd56d9a961f44cd67ca7b34ff85eb59ca1c116af0c6ba4c387e6
- MD5 dfce06caf5f4d2421a42d8725d729cfb
- SHA1 8f59c983cb60bbc49f2b44cfe672de08c0491dc8
- SHA512 0600e588c2fb95592acd627ca97942fad3075d9169a79ff3ca8096fd743286b52694f57323dce0f4af2babbc5fff7ba43321f6c90a56d2b58c4e6b0f3b99d196
- SSDEEP 12288:E34fnIsCz0pL5gtBhJHmtkSJ8cfRrqi3ApzINsjCTEjz7k/q:XfL00+3JGqlxCsKEjzR
- TLSH
  T17C259E217509C035E9AE11B16C3DAB9E819D5D2B0B7044CBE7D86E6EB9340E37B32B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 27KB
- SHA256 822f75b69dd87332b5995528771923ec74dc5329c65094bf4e372eb8ef42bb8e
- MD5 e87068563fc18e67a78230067cc240e5
- SHA1 37cd2cb5581fc575b8c46383d877926bda85883b
- SHA512 dab6b330d73abadb63f6eb02a5bc87ce9b9d1bc64fcb9289581cfc2e04be0254893945b3bdb762b382bb491388e34bc018f098a489908dfbc9feca2a9ba13d5d
- SSDEEP 384:E4C43tPegZ3eBaRwCPOYY7nNYXCT/YosaiZSf+VIYiWL3LU9Pxh8E9VF0NyzDcHF:ElTgZ3eBTCmrnNAho/YiWk9PxWEZsOe
- TLSH
  T1FDC27C6267D45C33EA975E307AD192269FB4F7525881CA83823B8E021B553827FFC375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 23KB
- SHA256 a91aa7c0ead677fc01b1c864e43e0cace110afb072b76ad47f4b3d1563f4dc20
- MD5 938c37b523d7fc08166e7a5810dd0f8e
- SHA1 47b9663e5873669211655e0010e322f71b5a94be
- SHA512 77afe83fb4e80a775dae0a54a2f0ff9710c135f9f1cf77396bc08a7fe46b016a8c079b4fa612e764eea5d258703f860688e38b443e33b1f980e04831739517c1
- SSDEEP 384:58QIl975eXqlWBrz7YLOlACZSf+VIYiWLbLWQaZdPxh8E9VF0Ny0W3N9:5gPgrfYLOWJ/YiW8PxWE6Y9
- TLSH
  T1EFB28D2346505CB2DD46893074D92936AFB5768299E0C9D3A357C142AFA07C37FFC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 30KB
- SHA256 018cba12efaab3ec61cfa2c54772f0e070452d57f2fc71026826fd7e3f59bd39
- MD5 bcb13343ab422d2c7ce98e324bd02c8b
- SHA1 b6e633426c0d9f3d1f2ef0cf4a27218974da1f7f
- SHA512 dfa02415b6c2003eae5b19f49726536d023bf72dc1e4f123906c1e2fe6200473db8e674e94947f6e07f8cda9e0bbe28cab968225968ee832b8e4bfc5997240b7
- SSDEEP 768:V3wCtynHJAIl0CU4K7yAB8tpVdDQJNILw7/YiW+LZPxWEJY:ttypAY0WqVB8tpVdDQJNI07/7LPxA
- TLSH
  T182D26A66897048B1F97788B4B1E03E232A7DFD0258A0D5E713EB86055A603437B7E73B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 57.9MB
- SHA256 d104a7da973c395e1a86716e2dd170d89e2a09cd002ec1e95d1e83891368ea04
- MD5 1e278ba7f613d1bc3ba6f4c00bade078
- SHA1 2171b13cbaac1829b796907d724abda10d2eaa56
- SHA512 083f47e90431331ad60c328b14cf2039ecf47a2b77c13cefa55353c21e03918dd1239ecd3b0bfe0da7bf16234ce23ffd125d32c522998b0e8b97b983b1161665
- SSDEEP 1572864:Of0vTZC9zWiClXfNb/yAd0FBZOHMuVmC+1t:Od31t
- TLSH
  T192D77C2071624022DC8601B16B3F5F7AE5AD9E27276C48C793D4FE692C65CC72A36FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 13.3MB
- SHA256 591cc691428ae851b30e9b5b2c83cb158043bb4e887dbee248516a40eb94544d
- MD5 da119eeae9d0f4cc762a5adb78a90c0e
- SHA1 6982743d0c15aeebfebfe3aed492b43dfa1600ca
- SHA512 c2cf3048c7195594fa8f9bcae2b52c4c0afe1013c56401786ccc5719544faae254cc26eb273c9e8979acc9a5d1f895bc0f14877c9654627fbad475efc1883083
- SSDEEP 196608:NlAxI8AGoHNHAqeD6bGzBxDxK/53JIlosFCXAkgMVFVpyJ:NtHAqgqcBxc/rIloCCABMs
- TLSH
  T108E69F60B1874065D18600B0C92EB77B8768F92947F285E7A2C0ADE97C75AC23F77B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 575KB
- SHA256 64a4d84f2a5e60c1497bc7d92becbd9162d5707f39f607a9faaf621048f44910
- MD5 d7606415e5d3db520bb37d74d27bbe5c
- SHA1 9da03d2b851c39fadaf6e2c087d8435c890f8994
- SHA512 4d1ab5942831971c25b6600a4416a4bf23ad690c4dfb06bd582005ec3af26366feb7f6aed6073e8bce2343cf4945a25a738ed16fae503b51e2af42b34878ac8a
- SSDEEP 6144:vggEITQG0AyZP3rece87nWHmvaUer9xJXg9lAOwhoQrBO9E:vggEITQG1y53CceinWHmvQRXg9lSbI9E
- TLSH
  T17AC426727DC5C463D8528DB2F92896FFD529AD31FA58048B7EC03E2AB970381BD31A15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 373KB
- SHA256 10504607478067a86bee1dc69ab349a736b1137521a09111dfad5721d297d00e
- MD5 513ffc1fb618095c2ef8c1930d782ed0
- SHA1 9175900f4a5710a1847e6fdba47ebeec98c1faac
- SHA512 7aa5b419438a6f8ac081b5dfe5cf6665451251f0211feb51e58c6f293a93e0775eb319db3d262427807ccc9dffae18052ae62d02924f7396c7dd8dfc18b90f05
- SSDEEP 3072:qNtIX+j7T4YXQwhoLZtXICyULHFjHJxnPYl+awPZVYlN6sMsd/b:qNN7T8who7DZiwP/YlN6YD
- TLSH
  T19B84BA011E9CC23CF4A7A738C923C653526D656BDDEC723E47388A181AE44709B5FAF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 437KB
- SHA256 9daf7c0153b764151c1fd4d3ef0657930a0ddb5c22f51b0872b89945865b5bb9
- MD5 64b881d33cefa652bc99a533296ab23f
- SHA1 218505017b86df511b354bf5b29d4ea8131831b3
- SHA512 9666204ad515316d30198d591c98e9efb45c5d675e8d1cebba5542d9e01e76f9478175bdddefd808c3729a7306a1f88aaf2593c17816086780e64ffa697ce513
- SSDEEP 3072:sNsGpzFbhhqXjJbAMDZpRA01jr0fabYjby/59BoliII7psM8ZosNx2akpOxlsRaL:sNOmMYDOi8wL
- TLSH
  T16894200FB9BD9240FAA5D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 407KB
- SHA256 795f05f3b9b02aeefd6fa2165bd72a570488eb18edd33caffbc96507c37ddff9
- MD5 57a20b60bdccf1a339c607c74693d3f9
- SHA1 22c0ead23cf35f2be9e812cff6b0cd5d7589514a
- SHA512 f2046606b86c429f7eeef25bc2095ee558361ecea5be07691337d486bc8de814281efec9ccc7421df6a3ba2463a90757b08ce1880c2b52826ada8da16d32499e
- SSDEEP 3072:PNE0kkALenmGn5ea0hOL/LbDusFbBtQFNWP6ZPOxjMaWg5iCFvVGZCo1yUvq5AEp:PNzlH2MQAO9u70EFUu3rbP2OoY4U
- TLSH
  T15B94F20122FC0685F6F7AF76ADB406624E7B7CA2BE35C24F9550429D1D70AC0E8A5B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 401KB
- SHA256 dad39a828e6cfd77b1ceb94c2f251054097f73f20412c1f2f2f512a1bdea5f69
- MD5 0f7bea067fd543bb1e216a4937724759
- SHA1 62e0d96758d1e6c127da742653759cde8f658051
- SHA512 92093542b47f568f4d5982d0f5b440ce260012d8b6a10a3a700db87ec1f0d59530d5954a980081d62eeaf8dfcb0f484d48c4803fd7a4feac5aa6097e320660b8
- SSDEEP 3072:NNRn5gGpUXPql7P07P6W2ZOxCT5OShtiOncyct7HeDzMC+/CDedchrfi/wzcJpHF:NN5q70sErYR
- TLSH
  T1B894A75123E95609F6F73F34BDB902945ABABCDAAD39D21D1210509D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 449KB
- SHA256 c5441729770210cf2a62003293b851653f35c95014189477bb2eb8264076d6e9
- MD5 e2803a653f35630c69e85a069a33ae73
- SHA1 ba68df18d7da064f6a657b2c4765a218eff212e8
- SHA512 f025b2613a7c570f86f718b7c688d820880518bbaa0bbc876d05eebbdc8964445b6e175b6bac74829d0eb1f5bb6c85a728d5a4a63644d5ee6d4c90c8235a5a92
- SSDEEP 3072:ZNs9PNMHDB74Zpf97C0QpqlCumdO5XyzTFmyGOak1vofx9fuxMBFcKjXSSnNCxpx:ZNycq6uWtvvXbG4PD
- TLSH
  T1ADA4EB6153E98618F2F37F74AEB862946EB2BCE6FD79E54D1310509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 476KB
- SHA256 c98259e3b5942304ac53f0e8a5a95bbb1519e8df2a292805fa67af795b18fa35
- MD5 6c8c859dfe8a16bbe7d56e18095051e5
- SHA1 fe150a6226c0d70d5ce330437ad206b6e7613377
- SHA512 ee8c4336c219cba6adc2ca56450975cc0e930e7e16183598e284eca8748736c40973ca11a0dbdf4f5289e337552340f6136fe7afe1bd608e7f9a7164c47fa281
- SSDEEP 3072:ZNNLyTZk1/K/UKMw8LTFc61Kpl4n3INi1N5F78zocrJkdd2wQfafv+nAXFFHrfC+:ZNp7TuwSoPNdVIM44DPcB5GJj4NvFe5x
- TLSH
  T10FA4278D0DFF2711EEEAA9F2583341565AAFF9924828DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32