d8f7b151af3501eb3a3b74ce2944f9ddff0d7f18858454e81dddacd6fe2f6217

Sharing

Copy URL Twitter E-mail

General

Target
TeamViewerQS_x64.exe
Size 35.3MB
Sample260822-pkslyathkh
SHA256 d8f7b151af3501eb3a3b74ce2944f9ddff0d7f18858454e81dddacd6fe2f6217
MD5 3e59f5f4e1c016f7d74cd3134e50fc8e
SHA1 b9dcd5b5185107622c35195d1356ccfc62c051f6
SHA512 e82aad1fb094b07102fac7c024c8791557e7a1e0c18b26e39258d164fdb221bf37c69a40cfb35aae3f4cae69e837ef0d9482bdea407ea0b8a5954afa0f179602
SSDEEP 786432:DdX7M6cxzIHAKuCfanVBhEqVsi8tEW9dBnFCw2T:DdAjxzI7foVDEhi89nFCwm
TLSH
T1FB87333AFF922507C974BFB2216857DFC6F36E886EAD89131D80741832F23914D25D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  TeamViewerQS_x64.exe
- Size 35.3MB
- SHA256 d8f7b151af3501eb3a3b74ce2944f9ddff0d7f18858454e81dddacd6fe2f6217
- MD5 3e59f5f4e1c016f7d74cd3134e50fc8e
- SHA1 b9dcd5b5185107622c35195d1356ccfc62c051f6
- SHA512 e82aad1fb094b07102fac7c024c8791557e7a1e0c18b26e39258d164fdb221bf37c69a40cfb35aae3f4cae69e837ef0d9482bdea407ea0b8a5954afa0f179602
- SSDEEP 786432:DdX7M6cxzIHAKuCfanVBhEqVsi8tEW9dBnFCw2T:DdAjxzI7foVDEhi89nFCwm
- TLSH
  T1FB87333AFF922507C974BFB2216857DFC6F36E886EAD89131D80741832F23914D25D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  TeamViewer.exe
- Size 60.2MB
- SHA256 801d3f6a051d26e505636520f18cf13161b5a23282b1d2ce2e081e4d3c5a7193
- MD5 71ee261ea579b857dc61a1589364afdc
- SHA1 9b124ffbe41817ed9a413fddfda0ddd4631efcec
- SHA512 3d75d42d4a7ff41662f65d74d0bfb8d6acbb01a79986bec677bb29636eb061b23b274f061380e908d198aadfa9ec883dcd03ac6a8b0f622c0093db3428d8d43e
- SSDEEP 393216:L8ifEWUqpO4JX4Qnih6lzjp2rrJnoNp630YMOD6pVHFjUzPlc+rDcYl2vuOiiR3r:LtxpnihK0HVcp6+GbrXUuf8wKp
- TLSH
  T104D78C07A1E801ECE0BAD17DDAAB8917EBB27809033157DB06D0865A1F67EF09E7D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  TeamViewer_Desktop.exe
- Size 18.7MB
- SHA256 96363ba13afda76156bff491c0241a3b2de0f2a7a1eb41a4700e2ae836042da6
- MD5 546c3d511d3781d5f9ea0cd36197a10d
- SHA1 30a03535b5104ff3da59b71d82bc95f102471f2a
- SHA512 4d09dd8d1eafe79f3fd9ffb9196d2a4d932f12e760aa557f4459f23cd119d9fc880272bb2468c43f4d31d65e8b766eb67261ee0ad3e5df639633e1e451d9080a
- SSDEEP 196608:1zcvLrccXsTd80VcduAwFTBuVoUp0vJVoYeRVFkfDgLem:1IdsTdcdSrJVoYA3Lem
- TLSH
  T1E6179E17B1E801DCD0BAD179CA9B8907EBB1B80903B15BDB06D085A92F77EE06D7D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion spyware trojan
behavioral13 behavioral14
- Target
  TeamViewer_Note.exe
- Size 628KB
- SHA256 17503404a865ddcbf80db884ae5caf6797f34af261f3b3f607ead2c31ba6276f
- MD5 050ceb90f70b0df912d625f23427007d
- SHA1 f6ffbc2129d7917e9bf0e23c5c3481bb51f2710e
- SHA512 dd5618a6d878ebd0402b0d32cae511992be8ac3637a346704e92897462e0606ca49b934c882c8f70ee55d3c3660a1e56124f49434c505a70eb7a3d75184e9431
- SSDEEP 6144:uGEZUQz9e5R7kKBDthDeu7mYp2mIYoqLOrPAwMVL2VRrZtf:QfzAHoIUAwMdUZtf
- TLSH
  T1CDD45C75BED8D0A7D4268C74F94A44FFD6216C22F758958B3EC03E5A3A32790BD39A01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

defense_evasion spyware trojan
behavioral15 behavioral16
- Target
  TeamViewer_Resource_ar.dll
- Size 369KB
- SHA256 1f99ef863850d99cc7ff5ad3d3b29c2ac1cd2a527eb298e1cd1817136b8fd4b3
- MD5 990a047ffceb17baeb4fb8059a8dfee0
- SHA1 d67ce9a511d0405cb5ef7c8553073218346edf88
- SHA512 40a02fa3dbfc03d3194fd011d4f148e18520442e6f61cb7b2a17555719c1a20972c7ea9e2d19421ef9df42a044f9c8aa8c5652bc3f7645bc9065ad395fe2c625
- SSDEEP 3072:7rtZFB9xTDhP/uWFaROs+jhUuZnJxy3YlmBdVLB99lF64O3J/6x:7pxTxuWS61hodVz9lF6TSx
- TLSH
  T12D84AA011E9CC23CF4A7A738C923C653526D656BDDED323F46788A281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  TeamViewer_Resource_bg.dll
- Size 434KB
- SHA256 0d86b5edce7967d23a927974b2cb7e1df43ed222bd84023d6dc1254d105564f5
- MD5 435bb177655561880f474001309c44ca
- SHA1 da9c08f7557de0fea4797e538213dfbad4d6c662
- SHA512 14495f6786fec8615e884cfa6e0a8eabc8ed596f935dbb11aa4a02c45ce95578fe55dfe223e3382936d14a1a9ec2a7116e9a2d35fd5b072547bb05998706a807
- SSDEEP 3072:9Hs14jFn5PqZ98IsAODZpR9Br+9zaYo5pIO/NSkxhJQphhtrRa9W+975fm1/Xa:9MfparUSP61/a
- TLSH
  T16694320FB9BD9240FA69D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  TeamViewer_Resource_cs.dll
- Size 404KB
- SHA256 3a0a57128c3a0856fe742d0d61a551f132ed3e4e3686918ed9767b5ede347bc2
- MD5 a7626cdce354206c73eaeda831d5c86b
- SHA1 baed234be2dc5cba46aca89457b40cc1e2eaf601
- SHA512 b182bd31cba18494dc6b6fd43cd23eacd1e35424346ccee759252c480dd159c38700c7c1e359ffd7b788bab09ceeb0d2a12332736a05c639e19af51e6bde8248
- SSDEEP 3072:EJmK9kkALenmGn5ea0slL/LbDWsQOBY3KBtQA3LP6ZLRxjMaWg5iCFAVgZCx1zos:EJ1GD2MgloC1R4vmUc7Vrbt26/oo1
- TLSH
  T1AF94F20122FC0685F6F7AF76ADB406624E7B7CA2BE35C24F9550429D1D70AC0E8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_da.dll
- Size 398KB
- SHA256 c272b78a7bf06eb4d48bba6743ac6e0d01b19fc2493e907d171dbbd65e18fee0
- MD5 2172631cd84939ed335949e8445cafa2
- SHA1 4e445dc100d9999970dee0df92cef01acf48246b
- SHA512 c74809ec5ef009e351c03b5917e0c9aacc77aaa610cb8fa39a7c0db1751264278b12af7283153533d3eb93badaf2bf95de8834895441b2f376467229bc758658
- SSDEEP 3072:1wQIQpskWpUSPql7P07PNWdZOqCv5Oy12smnB007JGDzM0+/CDxdjU+fR/k+cvwe:1wYHgdsN+TS
- TLSH
  T1D684965123E9560DF6F72F34BDB902945ABABCDAAD39D21D1210509D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_de.dll
- Size 446KB
- SHA256 4f2467e328e728cd9aeb5c65b7b0d30ebe9676c6b0c9778ac77544da6c5e7dd5
- MD5 e08b060c6a31856695430431d913f666
- SHA1 f9db78c855811dd341225dd3bba6234d5ca75440
- SHA512 c567e7d2158a32b528cfdb87302a51cfd33990e98d9c66d419a409e3d2dd97de6667e7beeb9a9632f36af388c4769897de64fe9b80422bfe38503723a7a2a842
- SSDEEP 3072:WiC5PM1HDB74Zp0Fk0k0C0spiVCuuY15XyzTFPT8y1OWX15Afx9quxM8lsKjSCNl:Wiw8geDWtT3lUOxJM
- TLSH
  T17CA4EB6153E98618F2F37F34AEB863946EB2BCE6FD79E54D1610509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_el.dll
- Size 473KB
- SHA256 d8035b03f9b3ea80fa4431bc900eafc12f635ee8a7a991f000fe0ecc48296793
- MD5 ffb5420132acf1705510ca68a5d7dede
- SHA1 4556fb7cbe238cf16afbd1074980be83338ede52
- SHA512 71a0fcfdb0dac592cf0b261568fa41976b49f60dbbb6e3b4ea7ba694e40e84839f5cb1d2da2e1b044fd694e4ab37733b6e64dfcb60e80f672caf6d948700a928
- SSDEEP 3072:2ph5zZk1SKMw86TFnb1Kpl4nXIN5Gt5F78zocrJkdd2wdfafa+TWOXpyg+CUOPlW:2qT9w1D9lPNdVaM4aqdcBGZJepqvLiqz
- TLSH
  T1CDA4278D0DFF2711EEEAA9F2583341565AAFF9924828DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_en.dll
- Size 387KB
- SHA256 ceaaa573dd739932a25bdc56f1be73b231ee184a05947d949455dff3ae7ac96f
- MD5 5596b90a2909373454394f1ce34bfaf7
- SHA1 7cb5513f9a094aa58bb4832eb9813de6da813612
- SHA512 195d329dcfc2e5ccc373a2289a2ca7962b5858537a7d1a864a5f4b9637e346d765e414940f781b77a8cf24628005aa9ab9446d813d5a7d385a28f356601027cd
- SSDEEP 3072:Medu8C3PdESnTI+SU73g4WK0yfsu7nMJ7WkQ539L32Jvuq1ICY//F:Mzp19sEnqCz5Z38SV
- TLSH
  T13284965163F94608F6FB7F74AEB926604E7ABC96AD38C29C1250405E59B1F90DCB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_es.dll
- Size 442KB
- SHA256 2879413594d5c75989f43dd7b79fdfbb2f4e2b07e0a85fa0dfe2538ad37d55ec
- MD5 bbc5bf0a31c5eb7c6662a580e7647efc
- SHA1 8f3bf217590ec8a6a53aef0c342c4fbc0c3e7b72
- SHA512 c37b4416afebec5c907de5c5f332d33c8d7754bcdc5536a99ca664e2809e82ddbdf66e3d901c310c2fb8188ecaa859ae438eddd3010eafa368b05b9c6747e989
- SSDEEP 6144:Vg7AATqp3th20F8ubHEOs37qeLh+aL8y2+iAR5KE6y7YJ2hQdAiEZfglEnnzrsOw:yOt
- TLSH
  T1E8A4415067FD6246F6F37F38A97916658E3ABD92AC38C14D4220525E0DB0E84DEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32