4c728f534324893f3678999232961a316f029a36677a5d86314b68a5f40ddec0

Sharing

Copy URL Twitter E-mail

General

Target
TeamViewerQS.exe
Size 15.3MB
Sample260820-xwferatgja
SHA256 4c728f534324893f3678999232961a316f029a36677a5d86314b68a5f40ddec0
MD5 73ada020bdec6063260cf9d1052dceb3
SHA1 d8b9218433c877d73f9b65db97298066b05c11ee
SHA512 463d3b4434c6b8ebb3a9c55b34fad8ec489a7c57a329f6d46c892f73af90f7cd2f23dd8c63dea4700180ba4e072899466f28a8198ddf2a87f515aaa9520de5bc
SSDEEP 196608:2JSIDN7W6UxkzHV13KIZqqkXzmWLt+Xa/EeLglglwDYRcc+zvVpCEVsp:2LDVHUQ1t50zmWR+XWgaSDYEQ9
TLSH
T1B9F633E9D7E342A3F8352E36D692227871327ED964E11CF4568CBA2C4D311DE970E92C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  TeamViewerQS.exe
- Size 15.3MB
- SHA256 4c728f534324893f3678999232961a316f029a36677a5d86314b68a5f40ddec0
- MD5 73ada020bdec6063260cf9d1052dceb3
- SHA1 d8b9218433c877d73f9b65db97298066b05c11ee
- SHA512 463d3b4434c6b8ebb3a9c55b34fad8ec489a7c57a329f6d46c892f73af90f7cd2f23dd8c63dea4700180ba4e072899466f28a8198ddf2a87f515aaa9520de5bc
- SSDEEP 196608:2JSIDN7W6UxkzHV13KIZqqkXzmWLt+Xa/EeLglglwDYRcc+zvVpCEVsp:2LDVHUQ1t50zmWR+XWgaSDYEQ9
- TLSH
  T1B9F633E9D7E342A3F8352E36D692227871327ED964E11CF4568CBA2C4D311DE970E92C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery spyware stealer defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 831KB
- SHA256 a9f17262b3b4957e9efbf6ebe54400c7b7544e4fb40bf84753cd3bdb7053d035
- MD5 45943916ee7dc57cc14433a2a8bf6dc5
- SHA1 eb6bd53e304954051f02207a9db78d9e61cd97b7
- SHA512 a036fe7943a12f7956367265c6732c485f0f0b9ee964cc4ecceace46239ca019d05e37b8adb497e1dce36c468d45940f3c29f3b6c8f22abb4aac92b1f13321f8
- SSDEEP 24576:QIW/PvX0/qfjdiZ2dUktBe+63oEmV+oVQ/ngeKsS/D9:QLnvkCfa2dU6Be+63oRVJVSgeKscx
- TLSH
  T1FE055B307E19C136EAAB01F1AD3DAB6F416D6A550BF884C7A3C85B5E38745D22B37243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
- MD5 033ee34c40e8fa85bf2739bcb2f3e186
- SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
- SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
- SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
- TLSH
  T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- TLSH
  T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 228KB
- SHA256 e721edb07e9a58dd696691d2492f1b3238974b35ae5401798b00c5a382d9ffbb
- MD5 de5041a1efd290a8bfc405f4a46168ff
- SHA1 4add2640ae5cc100769e604932ed1dd1e71f6608
- SHA512 dfa8f382ab2f922d9c01e5ef0dc7f0fc0e2fbd11ee131d03157d469bfbbda87b10c2d1cf0ad590e880a82ea7988354ffc19f6bd4ffa34254af502805a66f1190
- SSDEEP 3072:/E/4nvafk443LbdT30B9pRdySGnYmEegCtzII3VCclQIHr3K+Go:q4vI43dj0BTySBWjWwfXL3tGo
- TLSH
  T1B1345B1177E08839F6B71A306DF6C6604EB9BD326970D19FE790C91A2E70B85DB24327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 18KB
- SHA256 431fc2ed27d0b7a1ce80de07989595effcc3ffb1dea1af6c0e178b53f6bd2f1e
- MD5 e89c7cd9336d61bb500ac3e581601878
- SHA1 45b2563daa00ba1b747615c23c38ef04b95c5674
- SHA512 09485a354ac4ace6084cb6fcbd92eee8488074763c8443638f78e655e45e8aa0fe40a45d4ce0dff116ed3a4bb7bc4d7d845a6ccf0e0bf35533ce81626a8db06f
- SSDEEP 384:u1ju3wCtynlKEJAIl0CU4BNe0i5wsVEABy/7tpnYmdnDQVJlN/BmqIw4n:t3wCtynHJAIl0CU4K7yAB8tpVdDQJNI0
- TLSH
  T179821885657181F2F5B294F8B1613E132A7DFC121835E9EB0BF30B496864513BB2EB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 32.4MB
- SHA256 3678ccec2b851d3a2fa133a285e3e5cc83f5b63e5ff9a123d6567625e5f325a3
- MD5 2ff2406c41e6e7a7b72ebb138614b0d4
- SHA1 5959843f53a78072da4577ccf86c326fe7026c71
- SHA512 b5c1df2e3b1ac055c0f0fa31b481290936c030455bb45638ab0cf1859dc0ba97d0babf9e7cb73d26735563c1b649c903c723ccd9e30639833e71a10c19ee3192
- SSDEEP 786432:NEtIzLtT2KbpXZOGjJzUNmNwz4pN+YAEKfe:ytIzLtbbRZOiJAcNwMlKe
- TLSH
  T1F0775B31B399856AE99241F25B3D5B1FCB1CAE0F076405C762E8B97E2D344C31E32E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 9.4MB
- SHA256 954effed5951dc6c885f2add3bab8df05420a49de93aa090af0bac8f67b22cb8
- MD5 d9febca1c65ce89186279d5c490f6cec
- SHA1 aee8dc7038e37e1c43e53fc31f9fe344e29ef7f1
- SHA512 e3e7c9f592a8bd14e133ccba61fdd0aaad8e1049d0a5cec5507e31d3bb93060cb4b8120597a49fd2e7b87750682b778077c59f5812bc97b94eb9b393f4bdb72f
- SSDEEP 196608:aVYw8ItczctvUn9EWhz+CmyBk4eMiyEsFad/0:Fw8ItczctvUnZsCdkZMGsC/0
- TLSH
  T1CEA69E70F2D38926E95605F1893DAB6F402C7E554B2484F7E2D8BA5DAC307C31A32F66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 665KB
- SHA256 4e31f107aca8334ae950695913c09dac1967a5e8cd51e67c8455069760754e6f
- MD5 628e0a8b33c144bde67eaca54d401245
- SHA1 22380291ee0c393baab1f8279925ae94dc65c06e
- SHA512 bdf64d1da459932495a92b7febfac9e0228341fc295210e98dae811837cd80adc45cfb1b7bc4685b816bf0d25815c6dfeec4d7771ad7a9722f8c720a93df788e
- SSDEEP 6144:4DP34V0zhw3O8RGLX7dOLgxuaT8A9CLTsedSBIYyrG:S34Kw3O8ILXRckZwAQ3seGirG
- TLSH
  T1D6E4D670A582C123D423153DEA64D6F7142BEDF0DBA079E726883E2B7A343C5953992F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 273KB
- SHA256 41503e625393a6b60fc4b8275a1b572854fa85fdad76544d27a1dde9076b5cf7
- MD5 93f5c8746478d2eb2ff30fb97c7c1781
- SHA1 7529a8a8f753c894a566f14e812c2f35555bccb7
- SHA512 1fbd465fe15edcbfeede200f74b5c44eccfd8afa93e8bd6edf7e4008ac7ef902ab03b9283d3030c7ec8bdd8c543c0c3fdfa8081dc335e3ff6fd67d5862534c31
- SSDEEP 3072:HYoTCQdEu0DS07+TitJ4/lBPUTd726BsN8:LTEutV0Qud726H
- TLSH
  T19854A8011E9CD23CF4A79738C523C65362AD61AADDDD323F46788E281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 320KB
- SHA256 67a848bbdec1ca081f55f90dd1f3b9e6c460c4c0463ecf60de3fa1b963a8c73a
- MD5 d3dc7cf5a4d6d448aad4e7bcf4ba3cfd
- SHA1 948931028f67b1d795bec69efdac203c8a02e066
- SHA512 de42169c5e7f21d553b1431a07dc34e735c66f6eb0cddeb2ebd95f1afd51c5e608931cd9b9b27cc514b0f9852a5c3821661505f77ea8b979dd4a13f13af06a4a
- SSDEEP 3072:yURZFn2CoS52HmlRtSvDry7DVnfftTmENjppeRaHF8Q/:y0Fn/
- TLSH
  T11264420FB9BD9240FA59D3311F6686E721BA7B1073395ACA835F7D68602CA3533252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 298KB
- SHA256 aaf26b0f90b0c18572c7c66680748356d722a468f89c2f4e8748b464a2fc2bdb
- MD5 5973080c7f1df152071407cfa672980c
- SHA1 b07e01d89f2821918a4f72e313e1fca8af3472b5
- SHA512 d18ed946568d28db64fe9d9c03e5d6540e0851f09ff0659cffd92ad8b293b8829019ce443cf412a81040aa1b64079ba79d782cb39d921f977fdd967c1107f267
- SSDEEP 3072:SSkkXBmyn5ea+1DUevb3LP6ZL+jOrZaWg5iCHVWZwe4EUa3AwGwgQqesbywmFF9G:7EpQYVbvKN3uofu29hm
- TLSH
  T1EA54030122FC0685F6FBAF76BDB406624E7B3CA2BA35C14F9550429D1D70AD0E8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 293KB
- SHA256 c9bdd523b434476f4263d7c23ecd0bf38bcbf1a844fca62f165c5300b1e1d1d8
- MD5 0cadcda69e79e64c5e99e4a553893921
- SHA1 b5d037aec5a3ab6b3db09e2652b0b912de15bd3f
- SHA512 d5cbe732fea1f5220c1c7f76843c0b94ee05f6d7a7ceeecbc21052ebcdfdbd3bea332b007fa1c4cec319750194e110cef87580b1f084c8203fca31ecc67c58e9
- SSDEEP 3072:rmD9rHp6pP0l7P07PdWpZRCF5OONgI7j7mKDFxm+/CDw//6nlSNSbb2cG0TeTuyt:yuXh6G
- TLSH
  T11554A85123E9520DF6F73B34BDB902945ABABCD6AE39D21D1210519C1CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 331KB
- SHA256 394472f3fcac9462998230d7cec6d1e4886192d427864b435825621c3d77b0dd
- MD5 e9a1ce1507bc4786358ef8618e359f05
- SHA1 7176b31dd270ec2675779aba12ec5f346dffb4a9
- SHA512 17328030071e4068b1323fde1ac54a72bbf8b2fa3dfac73a59d7f05d272d0ebc580eabe1317e72288a02603b484993cd64f934fa9fed1692da76913cee9b69db
- SSDEEP 3072:EPP2HY74ZblivPDbUiJtCuhqtDbKYXQzEdhyw2Xf1S9Ru/MElHKj1RnStnN8dcvv:0prjft7r
- TLSH
  T18474EB1117E98A18F2F37F74AEB863946EB2BCE6FD79E54D1710509C1871A80DA60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 354KB
- SHA256 b00a372eecdd5f035ab2bf3c9982e294700189faa1fdf7265c08e7dfccd28c8b
- MD5 0bd61760c42718ede734a69ca8f9b2a9
- SHA1 7670192d9e53eef59c5b2d3d3907912339797476
- SHA512 8e6ba7c046e8812c9eeae243f49338492b3e4b32e915717d7fd7826922adea70cf08e9ed42c626bd8cade9343e5154d74ef04e21da47ba3d1b54f73abe838704
- SSDEEP 3072:H/5/P+ZkGteK/QJEF6PKll4TIN2mF78foc2kdd2wnfafjXWOXDJf1CUOAldmweyj:Kp79cPNdVAoMIdof/s5ASQLVmC
- TLSH
  T1EF74398E0DFF2721DEA999F2583381665BAFF9924428DDBE72F07048E91DC114DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32