01c2758d16bc084f039d2d1390b2933f4aa7f3787a08e883cf6e4d3c904ab58c

Sharing

Copy URL Twitter E-mail

General

Target
01c2758d16bc084f039d2d1390b2933f4aa7f3787a08e883cf6e4d3c904ab58c
Size 25.1MB
Sample260905-dss2wsswf1
SHA256 01c2758d16bc084f039d2d1390b2933f4aa7f3787a08e883cf6e4d3c904ab58c
MD5 9306bfd0ca450da7e00ca3730c04a895
SHA1 5b780f0987451b85d579cce2f20946498684e539
SHA512 cb264ea3b22fa899925386ca0765f2963cad57996df737176f0f5df65c3058025628c1bde640ff88eaae6abb079aeba12a628154d5052853914590fa7983b455
SSDEEP 786432:yMGytBRcUX0OeKeZSDti6JFUd/knnr9eLst2ea:OytBOUX0TqQIFe8nnr9eLvh
TLSH
T1024733378B00A12FF8D06CB9B969521FA2B2DD70BA022157F8CF765559B73839D3E121
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  01c2758d16bc084f039d2d1390b2933f4aa7f3787a08e883cf6e4d3c904ab58c
- Size 25.1MB
- SHA256 01c2758d16bc084f039d2d1390b2933f4aa7f3787a08e883cf6e4d3c904ab58c
- MD5 9306bfd0ca450da7e00ca3730c04a895
- SHA1 5b780f0987451b85d579cce2f20946498684e539
- SHA512 cb264ea3b22fa899925386ca0765f2963cad57996df737176f0f5df65c3058025628c1bde640ff88eaae6abb079aeba12a628154d5052853914590fa7983b455
- SSDEEP 786432:yMGytBRcUX0OeKeZSDti6JFUd/knnr9eLst2ea:OytBOUX0TqQIFe8nnr9eLvh
- TLSH
  T1024733378B00A12FF8D06CB9B969521FA2B2DD70BA022157F8CF765559B73839D3E121
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 1001KB
- SHA256 3053b06883b8bd56d9a961f44cd67ca7b34ff85eb59ca1c116af0c6ba4c387e6
- MD5 dfce06caf5f4d2421a42d8725d729cfb
- SHA1 8f59c983cb60bbc49f2b44cfe672de08c0491dc8
- SHA512 0600e588c2fb95592acd627ca97942fad3075d9169a79ff3ca8096fd743286b52694f57323dce0f4af2babbc5fff7ba43321f6c90a56d2b58c4e6b0f3b99d196
- SSDEEP 12288:E34fnIsCz0pL5gtBhJHmtkSJ8cfRrqi3ApzINsjCTEjz7k/q:XfL00+3JGqlxCsKEjzR
- TLSH
  T17C259E217509C035E9AE11B16C3DAB9E819D5D2B0B7044CBE7D86E6EB9340E37B32B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 27KB
- SHA256 822f75b69dd87332b5995528771923ec74dc5329c65094bf4e372eb8ef42bb8e
- MD5 e87068563fc18e67a78230067cc240e5
- SHA1 37cd2cb5581fc575b8c46383d877926bda85883b
- SHA512 dab6b330d73abadb63f6eb02a5bc87ce9b9d1bc64fcb9289581cfc2e04be0254893945b3bdb762b382bb491388e34bc018f098a489908dfbc9feca2a9ba13d5d
- SSDEEP 384:E4C43tPegZ3eBaRwCPOYY7nNYXCT/YosaiZSf+VIYiWL3LU9Pxh8E9VF0NyzDcHF:ElTgZ3eBTCmrnNAho/YiWk9PxWEZsOe
- TLSH
  T1FDC27C6267D45C33EA975E307AD192269FB4F7525881CA83823B8E021B553827FFC375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 23KB
- SHA256 a91aa7c0ead677fc01b1c864e43e0cace110afb072b76ad47f4b3d1563f4dc20
- MD5 938c37b523d7fc08166e7a5810dd0f8e
- SHA1 47b9663e5873669211655e0010e322f71b5a94be
- SHA512 77afe83fb4e80a775dae0a54a2f0ff9710c135f9f1cf77396bc08a7fe46b016a8c079b4fa612e764eea5d258703f860688e38b443e33b1f980e04831739517c1
- SSDEEP 384:58QIl975eXqlWBrz7YLOlACZSf+VIYiWLbLWQaZdPxh8E9VF0Ny0W3N9:5gPgrfYLOWJ/YiW8PxWE6Y9
- TLSH
  T1EFB28D2346505CB2DD46893074D92936AFB5768299E0C9D3A357C142AFA07C37FFC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 226KB
- SHA256 aa301c3880417fdfab0b08f7745d403a5260f3ddcc331d7eb6281d45b9b36588
- MD5 72a2916b62850bbe1445eda79104f2bc
- SHA1 c73cff2dc8afdb7764614943e2d3e49540ce6bc3
- SHA512 f3d79ba4a94a137507731e670f78e4bbc6891ab77160366e5e45b8a0f220e7a825957a08925577d109ab952536122deca89b5fffdd89f967db8f1df41e9f2e2d
- SSDEEP 3072:Wxk3bYmDGHLQk4h97Dr8TTN/WIKI8NBkAC7cOzgX04h7fKl6zYbpa/cxs:n3bYmD0ih9fwTTIIKnCDHgL26zqpa/
- TLSH
  T1AB344C1173E48839F6F71A34ADF6C6604EB9BC725970D18FA790C91A2E70B85DB24327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 30KB
- SHA256 018cba12efaab3ec61cfa2c54772f0e070452d57f2fc71026826fd7e3f59bd39
- MD5 bcb13343ab422d2c7ce98e324bd02c8b
- SHA1 b6e633426c0d9f3d1f2ef0cf4a27218974da1f7f
- SHA512 dfa02415b6c2003eae5b19f49726536d023bf72dc1e4f123906c1e2fe6200473db8e674e94947f6e07f8cda9e0bbe28cab968225968ee832b8e4bfc5997240b7
- SSDEEP 768:V3wCtynHJAIl0CU4K7yAB8tpVdDQJNILw7/YiW+LZPxWEJY:ttypAY0WqVB8tpVdDQJNI07/7LPxA
- TLSH
  T182D26A66897048B1F97788B4B1E03E232A7DFD0258A0D5E713EB86055A603437B7E73B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 53.1MB
- SHA256 efcb64d4e8bdd3746875bf0681a03e37c311448df7a96375aa6ef7f7501ff3d4
- MD5 13decaabc361fea4acf203ec1a656d4b
- SHA1 c497b89c35ab6535b130f1da44fc443a0e82bfc0
- SHA512 87a152bdffd4682e0f5a916018c17d94cbd85489fe9e510d55c7b4248242238bffa138c97dcb9889f99be2740e7f4c0a920e0c1411c4543625335bc09a012ca2
- SSDEEP 1572864:GkoBw5RQjWuaxOFHreBAi3Xw/p7Dj9/cJM8VG:PQcJMmG
- TLSH
  T176C77D327D858326E586C1F1E8EC577AD52E9E26073444C352D4FB6E3921DC32B39BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 12.6MB
- SHA256 2e92d9bc0dbb2ac2b5df44160884087acb0a0e0fc747634bc371e6a4b75cb083
- MD5 20df215fb6fb48ec80868ee425d0891c
- SHA1 e88d8c4365804f023dbe315432274c1bb3e005f0
- SHA512 b5f949342a4738598b6f0068eab77111ae18099f4f94dafca069bc3a2bd29fa01a5bf2ac7a176059573facfcc5c2234618f1c2deb2780d086d328f8a28670f8d
- SSDEEP 196608:NmcZYeO4XAyQLhI0h4LBWd6gMTCVFVQ7L:xXFQCB46Se
- TLSH
  T1D9D680A0B587C025E18504B2CC7D977B8628ED2907F185E7B2C0AEF97D706C27A71F66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 573KB
- SHA256 de16f73bae8fdb538454eaa17d591bd9d557e02a9c389f4c3752d774bb8be482
- MD5 9d42c8d58f0af0378fb1e8de41ec7670
- SHA1 d5df1125233e1e469599244581d730731cbe0cad
- SHA512 a39b26fdaa2afebc953b74c1389219d3d3830be99e4d6ed26054cc9b0ea4d1bf405a9dff424a2c2fe52e99f58e20253912257773e5604fbef4a7a231e774a1bd
- SSDEEP 6144:CdEX9LuTpj8Qtj+oUiaaNWv6VEpMn/vx2rRX2AOoa0e3xhoM:XX9LuljTxJUilYveEjo5R3XoM
- TLSH
  T18EC404707DD1C463E4528CB1F96896FFC529AD31FA18409B7EC43E2AB970381BD32A56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 372KB
- SHA256 4d2b0fc2aa0c708dd5b8671a8db09856a94a9fa53e2ca1fdbd5bc0ef7a4364cf
- MD5 6ca7cb7e0a3fe898393680c38279a79e
- SHA1 6961b143872cfc46722624278e70fafdcc8d9be2
- SHA512 71666da6ddf39027711041a7f1b8b24633f87874dc1105cc6555380138fee4e9b8323e6de8640a9a7fe12dce352f2677f3f44906684e8cb200ac4a00573eee9d
- SSDEEP 3072:54PoLvTP+bfwlALZCPChUPHZjHJzn5tl5+B/VflN644/cQ/cxo:dLvTmwlAIfVl+BNflN6Bh
- TLSH
  T18284BA011E9CC23CF4A7A738C923C653526D656BDDEC723F46388A181AE44709B5FAF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 434KB
- SHA256 8e00b2b38088399d9cc1db9b6db5195f52ad64593a2ab5b50b763ddef297c9ec
- MD5 8ca1bafa0172906defe5730d877ab174
- SHA1 cac0f02e118176edcc1b9b43838e3d1cb71af266
- SHA512 9c3b805e339ad2abcab9ea098c6c0135815e7d6b13c6f54ca31f6c4f1ff5d8c472029613496852abc711f6041e37d8810b2702355ecdc51ad2afe4189454c7ef
- SSDEEP 3072:9sz9bK1qnjlbANJDZpRb01jr0fVbY0bS/59BolUII7psM8D4PXxu2hpHxlrRa9sp:8iNi8Q8b6VqE
- TLSH
  T13694310FB9BD9240FA65D3311F6646E721BA7B1073399ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 405KB
- SHA256 427b0ef926d8d6fbf355a916f5d998ee596561de4909c7774a32a5466735bf85
- MD5 35f4ee66a0929126079d557f52335f0a
- SHA1 0a6972869ae63faba99b8c56df01aaf720d920d7
- SHA512 de4ab2451aa1059e5da5f1d2d97e1d105940bacdd73c810444371121b92bd67f58e1d96cd2b39c9ec6cb3144e91061a7c5e2b4440718264c382424da2ddfb415
- SSDEEP 3072:8fyTkkALenmGnHqbaqOL/LbDuswettIqNWP6ZLKVjMaWg5iCFpV9Zw+1xUvTJAEj:IuyI2MBAstKvVKVSTvrZP2S3xMD
- TLSH
  T14A94020122FC0685F6F7AF76ADB416624E7B7CA2BE35C24F9550429D1D70AC0E8A5B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 399KB
- SHA256 220b7801c9277239b5ed42eb8d8ff17ed9bcd4274d48a983580651488dab4904
- MD5 9bfa5cf2f69f7a2707dc002b7cfad939
- SHA1 812fa1152351bc583d2f508ecee99c0b73438e7b
- SHA512 3e8e8ed9851369951b0357a61aaa4663e6c7d68d09d64b3bd737e8c853093b7d632fbea9ef95135d77d76cc1416b373aadb92b31eee467dd7d59ad1e96342c15
- SSDEEP 3072:/9S53npUNPMfiW2ZOxCY5OB6Pjrnc9cI7HeDzxsa+/CDf/ErKfT/wXcapTcGNee+:4R3NRCKbYY
- TLSH
  T18994B85123E95209F6F73F34BDB902945ABABCE6AD39D21D1210519D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 445KB
- SHA256 9c5bdb72240e780e6c684c8fe839e795a3ca9fcb8bba6f2206eb2b1567cd029f
- MD5 8bd84f649e56b6e1736fe3a46b0927b4
- SHA1 c5e5edd450a250344bc8a221d6bfc34766da702b
- SHA512 2d9f72ecf91c93df0e0a9819446ac916f161d281089c5b5a4addb9a0ff5c0bc4414080123a210ebfa0d3774245981cf002ea9ab0a3736351ecabed6c30e657d4
- SSDEEP 3072:ab2PNsHDdz4ZXN7C07PWqHyCumBtUO5XyzTF6yfO6k1vofx9fuxMBFcKjXSSnNCq:a5c8gJMtG/7iY4Y8
- TLSH
  T1A6A4EB6157E98618F2F37F34AEB862946EB2BCE6FD79E54D1310509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 474KB
- SHA256 d742e177bcf4ab95878406ea34c38fc6d845b6ba375894742fee07535c9dede6
- MD5 35470ae51e0a8b0d68f02e2d8ef42592
- SHA1 0ab54e11045b8144add1b3c7ee8af61c40011303
- SHA512 c4fe698009b0a0df9006ad969665f8910adbb4b186bb2200be61ca8746df0b702fda92062b19031855e6512d0d81abb0041c5fc5cb41895130c1f59ae61096ca
- SSDEEP 3072:1ruyTZk1NK/UKMw8KTKdhAKpl4nwINU1N5F78zocrJkdd2wNZ+sAXFFHrfCUO5lR:N+2TiSCPNdVDM4i4PcTUVJK6ivgt6y
- TLSH
  T154A4178D0DFF2711EEEAA9F2583341565AAFF9924828DD7E72F03048E95DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32