0899b626097646ab20eae51f6322b240bd102d65e576c4bab0a761404f9f4763

Sharing

Copy URL Twitter E-mail

General

Target
TeamViewerQS.exe
Size 32.7MB
Sample260909-en52bsbk91
SHA256 0899b626097646ab20eae51f6322b240bd102d65e576c4bab0a761404f9f4763
MD5 e6710f1e495d6fc00cab0f20f37be197
SHA1 e7b5535753ff6d198b6b108af608b2d03ccf6f0c
SHA512 0aab843e93cb10e8a8b8d4c94e5c8da576b40db99792d876112b1aa9e9b4b220861ad741b6a90fd6f5463389a8ddbf412ec1e8f8cc177c0323b61d814c0b32e7
SSDEEP 786432:FbTPZmAoUYQXkcLZPpiK1CidDSf+tSS/+GCuE/Cj6WjkbFs1qDMrn:FXIAlYQTPpP1XFC+tSvjuovS1qD0n
TLSH
T1BC7733929C120917EE7C4D36FAF96D3FEA3C1C14308ACA47EAD538679B3530E9912365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  TeamViewerQS.exe
- Size 32.7MB
- SHA256 0899b626097646ab20eae51f6322b240bd102d65e576c4bab0a761404f9f4763
- MD5 e6710f1e495d6fc00cab0f20f37be197
- SHA1 e7b5535753ff6d198b6b108af608b2d03ccf6f0c
- SHA512 0aab843e93cb10e8a8b8d4c94e5c8da576b40db99792d876112b1aa9e9b4b220861ad741b6a90fd6f5463389a8ddbf412ec1e8f8cc177c0323b61d814c0b32e7
- SSDEEP 786432:FbTPZmAoUYQXkcLZPpiK1CidDSf+tSS/+GCuE/Cj6WjkbFs1qDMrn:FXIAlYQTPpP1XFC+tSvjuovS1qD0n
- TLSH
  T1BC7733929C120917EE7C4D36FAF96D3FEA3C1C14308ACA47EAD538679B3530E9912365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  TeamViewer.exe
- Size 56.2MB
- SHA256 f29727fe5bc7055bef2735164f0adbe4bf78e5041745e32439946533fc225943
- MD5 4a36922a96228f7836a7dbc5f84ab4b2
- SHA1 13eda8655e59d54d66ccd9ccc58f81df0504b988
- SHA512 afeaf3ec5d410810c109a3e6813591e4b4d1116b2ccc9c3d6f67efd705a94885b283814c1e5e05ea6063cc982c4f2431a8033e4867eeb298014153015223c6fc
- SSDEEP 1572864:coFnUw20oyrcuvAl4VSRzELrfk5ai+j+76aIIGkZtnDp29Lzpleo5m/:G+s6eo0/
- TLSH
  T1E2D77C257245C0E2E48601B3756C73FAE52DBE27072644DF82D4FA3AFC614D72A367A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  TeamViewer_Desktop.exe
- Size 16.6MB
- SHA256 202d3db0548c8fab627c90f809a9428b5e4934725fb252e6ee45e0bd67eacebd
- MD5 8d67e221952ed1f64a6791c750a174df
- SHA1 69933c6b8bc0d752f429e0971a69743614a62055
- SHA512 bec93974359c2d7c3cf3185e37118c1e2e10fb60dacfa8f3e0f1d6fb1fb2404bc60787710cae52f425ee56ccb4174b991cf3d91289baa12c9230fe38ab856d08
- SSDEEP 196608:ReR984BPJaQR0cOGoxVQMwOhL8yRIQzT3a9LCbeeJHVAxgseHZk6a1bcBwPjIwbC:r46pGOVUo3zT3WaHVAaLHnJcok0q3y
- TLSH
  T154077D22B1464032F18201B1852DF77B8E39DA6A07658CD362F4ED2D6A70ED33B77B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral13 behavioral14
- Target
  TeamViewer_Note.exe
- Size 568KB
- SHA256 8dc6629b281a563b8fdfed60e1782e7e7ebcbe38adc41fabddc840ed26257780
- MD5 46c71a2b639957f012d1fee5e41fc5ba
- SHA1 7f3f75a2adef475ba755a70b5730d4b4227de64b
- SHA512 3c26c9421d92e9c391b6fab9f9212dd44d021fec1102ea3bca72a43adacf03f11c5e7c6dc222593607bdef500451b593596f1c820dae1f46651375e8974462fb
- SSDEEP 6144:g/4tloUrRzRvOH8erm3SxPsufj6lL4q3pCbGP6KqbOmNXK:g/w7E8erm36j633osHCOmNXK
- TLSH
  T16BC405707D95C423D5528CB1FA2996FFD529AC21FB1854CB7EC43E6AB534380BE32A06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral15 behavioral16
- Target
  TeamViewer_Resource_ar.dll
- Size 368KB
- SHA256 79d141317b4caa0ccdb1dfa3bea696ecb2437a23020767f5887e5628e2911efe
- MD5 8dcc72ef07cb0066da2cff59dd98b6af
- SHA1 4f9be0d207f9c710124c2aa3b7621d3d9e1efdd8
- SHA512 6e013da8db82e4b3685c392b051940b469ac6c55cc76c4168b9b971f68d293e08bb3c1a11e3e73dc69ac0b794d173d73846b1ded02e97e943b2a57a251f4abc9
- SSDEEP 3072:4sQEuB9xTDhP/uWFaROs+jhUuZnJxy3YlmBdVLp99lF6zOTZ/u:49BxTxuWS61hodVr9lF6+2
- TLSH
  T15A84AA011E9CC23CF4A7A738C523C653526E656BDDED323F46788A281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  TeamViewer_Resource_bg.dll
- Size 434KB
- SHA256 6011fc88c1de5275270627a07c3c808b3ef067800dfee3593f99102245f420e1
- MD5 47e4f7bc486ac0cdd3137d5364cce063
- SHA1 ccc3f1459c1706241028e2571d2d9df5a7ba8943
- SHA512 c5ba9ca2ce0b4c39bdf9ceb30045be33720612a89eec1758907251d39d3dcad05baccdb4eec7af07df7ec77f2a0b8c6d44b00fd6eadb54985c2bd222b4b4e21a
- SSDEEP 3072:JnxxjFn5PqZ98IsAODZpR9Br+9zaYo5pIO/NSkxhJAphhtrRa9Wl975fmG/Ji:Jn6parUSfNGRi
- TLSH
  T16394420FB9BD9240FA69D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  TeamViewer_Resource_cs.dll
- Size 404KB
- SHA256 55641b8cd6a6ebf656d15c64ce440402d720847587e3d3eac338aeed5c00f305
- MD5 1adbc5ac7b06332c68049144fa28b900
- SHA1 20ec2f1380492ad9daa854afb42dfdec231d67cd
- SHA512 43cd2de005378b9e41faf8946c7141fa997d5003e50ac3e307bb038035db4627090ddb2640ee6f8f523d1c96f8b2ea29ea6589d38eb6739c5c82d1afcd85f624
- SSDEEP 3072:+mYKkkALenmGn5ea0slL/LbDWsQOBY3KBtQA3LP6ZLRxjMaWg5iCFAVgZCx1zoUK:+mlGD2MgloC1R4XmUc7VrUt26/ZRNz
- TLSH
  T1C594F20122FC0685F6FBAF76ADB406624E7B7CA2BA35C14F9550439D1D70AC0E8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_da.dll
- Size 398KB
- SHA256 51b5fe189f60374c82af24b59db0cde0509efb83a72206e323825c2a327d5f52
- MD5 8632055a50e4554b1a69c6253a99b01a
- SHA1 12ab216f8d32200712cfac53cedf99fba8739fe3
- SHA512 99a9c4e9fa820ef2a0f7164767f144f154c9b2a623f14ed024c1bf8e5b3f82ada49d0b2d3b68d46a7fb426cf9f51ffc74acb318c39691acdcf1f9d94fb0cf021
- SSDEEP 3072:unkBpskWpUSPql7P07PNWdZOqCv5Oy12smnB007JGDzM0+/CDxdjU+fR/k+MvwN5:unoHgdsN+Sg
- TLSH
  T19B84965123E9560DF6F72F34BDB902945ABABCDAAD39D21D1210509D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_de.dll
- Size 446KB
- SHA256 919bcc3505efa6092d3a4d4d8bf025bc57955e111177d735f8140bf46c35a188
- MD5 795f83b9c48d7bdb7487d5802e59d025
- SHA1 7db39e11337e7b4f857227aa6381690ca227eeeb
- SHA512 fabce26a49f4f9043f290cff049d268cf9a9eb224e628d738815f35106b5aeac0490472756310faede152e3dc7ad591f9a0a78a57ac78305ebb7418dc8589946
- SSDEEP 3072:3Y/VmPM1HDB74Zp0Fk0k0C0spiVCuuY15XyzTFPT8y1OWX15Afx9quxM8lsKjSCJ:3Y/48geDWtTXlUg2r
- TLSH
  T19CA4EB6153E98618F2F37F34AEB863946EB2BCE6FD79E54D1610509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_el.dll
- Size 473KB
- SHA256 eb05bc55de107131814cb083c3353e3920a30ee3a99390bfb9855fd9b53316d1
- MD5 0e91e3fac3e42e4ec9e692129a7c94c0
- SHA1 15d3e6004d09bd40823012cb3d1767410263dd86
- SHA512 5dbeaafe02a6f9a0aa457d97af373ef4325b3be2ae82de5a26b95fdd498a27e48a5ff876ba1ce467869e9805c81c77e7f70208ed74104eb8a827d60532cb1fa7
- SSDEEP 6144:AEsT9w1D9lPNdVaM4aqdcBGZJepqvji1Zq:qmZtQow
- TLSH
  T1AEA4278D0DFF2711EEEAA9F2583341565AAFF9924828DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_en.dll
- Size 387KB
- SHA256 471712921fd6f3415fc6d4d9e906a718c1b2cd534a44bf6a1130b7eb3816811e
- MD5 784f1c0a3c483e2033d7bccd21b55778
- SHA1 e345ddc487a0b5bc24ddde75ed8e25773659503c
- SHA512 26fde942dc39050e83932204367fff7d081027e6f1f1c0df6376d542a93e6cd2e4b842d6276cf2615ace28349cf078198337f14ea22ca87f89203e077309e209
- SSDEEP 3072:neEb8C3PdESnTI+SU73g4WK0yfsu7nMJLWkQ539L32JNuq1nCW/GQ:nxp19sEnqSz5Z32r+Q
- TLSH
  T16784965163F94608F6FB7F74AEB926604E7ABC96AD38C29C1250405E59B1F90DCB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_es.dll
- Size 441KB
- SHA256 b0d0c0e9aa746b1a1af472a2401bd481f09012329ae02609364da6b9336d4536
- MD5 bbd9ecc161436ef8e04e476ea6340dd8
- SHA1 1bee1cb33ca13ef01254b0f518fcf1183f670c97
- SHA512 6eb466cc9aa7430a62ee73b917e36223bf8164db4d75d5fb84f43d11e72208fe8ab282ffff75530b6d3f5308c9ee534d1b00a43a5774b8355ef9ac257ee466d7
- SSDEEP 6144:b57AATqp3th20F8ubHEOs37qeLh+aL8y2+iAR5KU6y7YJ2hQdbBiEZfglEnnzrA0:/MP
- TLSH
  T1F5A4415067FD6246F6F37F28A97916658E3ABD92EC38C14D4220525E0DB0E84DEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32