dc5cd86b6f6ef5d89f031d6118c6405c234ffe91a0223ddba316d4370ea13fa6

Sharing

Copy URL Twitter E-mail

General

Target
nect-win.exe
Size 15.3MB
Sample260924-pc8m7ade89
SHA256 dc5cd86b6f6ef5d89f031d6118c6405c234ffe91a0223ddba316d4370ea13fa6
MD5 08112d6fc168e62444732a411aef46ac
SHA1 cc0eacb672ef4335e95854af84057a04704614e3
SHA512 d1b224a744604f82d7e78bb2072a541ee8ff5d46883f71ade62a587a9a64973fd79248674e4744b185e28d0b12c8880eb403d90c40927bb1d9bb2f6c0a270d07
SSDEEP 393216:Kj6YcGzcl+Fej4WqA3iQVkjfBLRkaJfiz:KDcGo4WqA3ojZaofiz
TLSH
T1F4F633AAE7E383D7F8361F35CB51267051363EC1A4E51CF96288B92C09741DEE61AD2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  nect-win.exe
- Size 15.3MB
- SHA256 dc5cd86b6f6ef5d89f031d6118c6405c234ffe91a0223ddba316d4370ea13fa6
- MD5 08112d6fc168e62444732a411aef46ac
- SHA1 cc0eacb672ef4335e95854af84057a04704614e3
- SHA512 d1b224a744604f82d7e78bb2072a541ee8ff5d46883f71ade62a587a9a64973fd79248674e4744b185e28d0b12c8880eb403d90c40927bb1d9bb2f6c0a270d07
- SSDEEP 393216:Kj6YcGzcl+Fej4WqA3iQVkjfBLRkaJfiz:KDcGo4WqA3ojZaofiz
- TLSH
  T1F4F633AAE7E383D7F8361F35CB51267051363EC1A4E51CF96288B92C09741DEE61AD2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 831KB
- SHA256 a9f17262b3b4957e9efbf6ebe54400c7b7544e4fb40bf84753cd3bdb7053d035
- MD5 45943916ee7dc57cc14433a2a8bf6dc5
- SHA1 eb6bd53e304954051f02207a9db78d9e61cd97b7
- SHA512 a036fe7943a12f7956367265c6732c485f0f0b9ee964cc4ecceace46239ca019d05e37b8adb497e1dce36c468d45940f3c29f3b6c8f22abb4aac92b1f13321f8
- SSDEEP 24576:QIW/PvX0/qfjdiZ2dUktBe+63oEmV+oVQ/ngeKsS/D9:QLnvkCfa2dU6Be+63oRVJVSgeKscx
- TLSH
  T1FE055B307E19C136EAAB01F1AD3DAB6F416D6A550BF884C7A3C85B5E38745D22B37243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
- MD5 033ee34c40e8fa85bf2739bcb2f3e186
- SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
- SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
- SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
- TLSH
  T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- TLSH
  T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 228KB
- SHA256 e721edb07e9a58dd696691d2492f1b3238974b35ae5401798b00c5a382d9ffbb
- MD5 de5041a1efd290a8bfc405f4a46168ff
- SHA1 4add2640ae5cc100769e604932ed1dd1e71f6608
- SHA512 dfa8f382ab2f922d9c01e5ef0dc7f0fc0e2fbd11ee131d03157d469bfbbda87b10c2d1cf0ad590e880a82ea7988354ffc19f6bd4ffa34254af502805a66f1190
- SSDEEP 3072:/E/4nvafk443LbdT30B9pRdySGnYmEegCtzII3VCclQIHr3K+Go:q4vI43dj0BTySBWjWwfXL3tGo
- TLSH
  T1B1345B1177E08839F6B71A306DF6C6604EB9BD326970D19FE790C91A2E70B85DB24327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 18KB
- SHA256 431fc2ed27d0b7a1ce80de07989595effcc3ffb1dea1af6c0e178b53f6bd2f1e
- MD5 e89c7cd9336d61bb500ac3e581601878
- SHA1 45b2563daa00ba1b747615c23c38ef04b95c5674
- SHA512 09485a354ac4ace6084cb6fcbd92eee8488074763c8443638f78e655e45e8aa0fe40a45d4ce0dff116ed3a4bb7bc4d7d845a6ccf0e0bf35533ce81626a8db06f
- SSDEEP 384:u1ju3wCtynlKEJAIl0CU4BNe0i5wsVEABy/7tpnYmdnDQVJlN/BmqIw4n:t3wCtynHJAIl0CU4K7yAB8tpVdDQJNI0
- TLSH
  T179821885657181F2F5B294F8B1613E132A7DFC121835E9EB0BF30B496864513BB2EB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 32.4MB
- SHA256 42fe8803e6165d1c1ff51471608d5e8a1f1fa70e5edf4e3de0a5a587066cd79b
- MD5 9a9407c77040ecc43c6fc8fbc0856dfd
- SHA1 92fdfd760a9866b990b789cb28b06318cf038adc
- SHA512 51db7d0af3c2af23ff57db3d32b66cdb97f3ff14a81f15edd77e8e9834fa29b1626fdf8bdfa1bdb0d6db185af8052707cb66fb448baa85377f0d54e0c174e45c
- SSDEEP 786432:DEtIzLtf83TKOqIz3vfBXkzKNFLWePL+mSfE:4tIzLtcT5qIDvpUzKXxwE
- TLSH
  T115775B31B399856AE99241F25B3D5B1FCB1CAE0F076405C762E8B97E2D344C31E32E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 9.4MB
- SHA256 bbb5514013eb49697a4ad8543340e097b271fc648ebc0757505ac847972d76a5
- MD5 84f91f72dbdea964d0066d80d287e089
- SHA1 21d99ef0dbe5ad24c8f8208fd3ac49d7b0cb7f96
- SHA512 2f3f97d1aa142c06d112a713296c42a6fcf050de2e8eb2417ea79de59056b9ba410e371894b2151e8b32536973e172b38d93d46639f7c8902e29cc70b9d9641e
- SSDEEP 196608:BVYw8ItczctWUCQPQC6cGv92BEoeM2vFNjd3m:kw8ItczctWUCecvmEpMmXJ3m
- TLSH
  T1CAA69E70F2D38926E95605F1893DAB6F402C7E554B2484F7E2D8BA5DAC307C31A32F66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 665KB
- SHA256 5d51aeaa23e227cc8ecf119bc6b8622619a7013e38eba7a8d43f3bf331265d47
- MD5 0a423ccf6e259127318c22e99e545531
- SHA1 62a8a49e5bcc73a946c0b2e535ecf75803957731
- SHA512 d163e945943d546b484fa315b1d3fc62009f5080eb8cf123d6721cc8ef3605500d45140d4d12be0882f840ad66b84c78276412b13bfb2252acf19c5836c03fe2
- SSDEEP 6144:jDP34V0zhw3O8RGLX7dOLgxuaT8A9CLTRmdSBNYyrg:f34Kw3O8ILXRckZwAQ3RmGlrg
- TLSH
  T187E4D670A582C123D423153DEA65D6F7142BEDF0DBA079E726883E2B3A343C5953992F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 273KB
- SHA256 f206ef9fda98df0d7e4ab3c849e2c42c69549b692afc13d7809ea9527ed00e55
- MD5 c2109f171aa784c56fb239698e9294e9
- SHA1 131e65d674ac2604ac17ca13bb5a0edc85f53da0
- SHA512 3886618ff082171c196af888c42b0eab69c903dcdf05a3e98f170ee3dc733029d37d1e491d6f1ee221ad7bdb7efe55b519fc64c663895a8e01263068dc489af9
- SSDEEP 3072:6RZoTC6EEuJD+07+TYjNJ4/lBE0T4726k1Rz9:hTHu0VWQ94726wz9
- TLSH
  T1DC54A8011E9CC23CF4A79738C523C65362AD65AADDDD323F46788E281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 320KB
- SHA256 9976907073ad8e4fe65c18285c5ff65ee8400a953c0fd5546bf8fd7f6be2753c
- MD5 4e59c8ca8f0c512272562c770b56b7f5
- SHA1 7253035f60674ca6ec653708d57ae10639e4f885
- SHA512 c7e7ec50180069a05cef18f046f35e0849316e6ebfb21135974c9ab1e6add4f2fab034c17acecae0d46c15c6dde92893db3d2e1856324ce97c9e5489bb5386b8
- SSDEEP 3072:Pm2ZFb2CoS52HmYtSvDr27DVnfxtTmENRpZeRaHsvyM:PAFZK
- TLSH
  T19464430FB9BD9240FA59D3311F6686E721BA7B1073395ACA835F7D68602CA3533252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 298KB
- SHA256 7c0724be44ec826e14ec3ae7425cad947080f8f5e727ef010a852a0843871d56
- MD5 986105b65c94bbecd02e8fa2e203ec0b
- SHA1 bf4e643677e8d8e2677b4abd5c560bd24c899b9d
- SHA512 31c453089e10595674b7beffe18b3ee6871993b2bd57803e1b7208324fa70bafeb0c2a139d4c2f8a65b7494f62c455184797949398dbb82d51fb018d5a074004
- SSDEEP 3072:zrkkXBmyn5ea+1DUevaNWP6ZLmjOrZaWg5iCHVWZwe4EUa3Aw3sgQqesbywmFF9W:DFCgk6XcKo3uofu29x/Y
- TLSH
  T18754F30122FC0685F6F7AF76BDB406624E7B3CA2AB35C24F9550429D1D70AD0E8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 293KB
- SHA256 d45875ae723bceed20264ced59b5983c3e026d7a1c258bca5a040cd9db9b6a83
- MD5 3ca2037710d842e8953a9de95810b8fe
- SHA1 2469e3c51ba395a93ab6cb18c685654c3379d5b1
- SHA512 0553b7e5dfbddf90e1123221d12ad5004be3da244e6604202377e8dcfe54a24a9564524552600ef91fd3a0fc0e6d1c41103bf6f266670e56b594ec6b43afffff
- SSDEEP 3072:T+hD9rFp6pP0l7P07P8WpZRCF5OONgI7j7cSDFxm+/CDw//6naSNSbL2cG0TeTDO:6FXh6u
- TLSH
  T15454A85123E9520DF6F73B34BDB902945ABABCD6AE39D61D1210518C1CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 331KB
- SHA256 6f9034771c71673755988506b903ad5eeab11eae21359e794f5a445b7ef6b19d
- MD5 4124dd927f6e2806acca0e1d66ac219d
- SHA1 9bfcb255230a8e1ce28065d439838379f10ade9d
- SHA512 695da05cc9b01279beaecadfdb38fdae800382869940d4c0434d1cc39d456503456c16e5db3a6d4d850253a0c60cd95cc9a6f14fcb638a454c99889c1d445d25
- SSDEEP 3072:SGP2PY74Zbl/vPDbUqatCuhqtDbKYXQzEdhyw2G/1S9Ru/MElHKj1RnStnN8dcvs:QQJjft8W
- TLSH
  T1E474EB1157E98A18F2F37F34AEB863946EB2BCE6FD79E54D1710509C1871A80DA60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 353KB
- SHA256 61baf35317e9470e06b7f57510885030cf01bbff0a021f398e09a8c98fc3594c
- MD5 d8140d13d473e2ba4333cdfe45aa4aa7
- SHA1 799fc7d30d8094b4dcf8fb2c3372a3763310d0f3
- SHA512 00f259b905e844b5f82f4822d411590f67165a9b45a6eb486647b1f1a9ecf7254b70a46390ea918a32ed974bddd90fadf14436aad395d93ec3ca5cbd0ffccd14
- SSDEEP 3072:lo5/P+ZkGteK/QJEFE3Kll4TIN2mF78foc2kdd2wnfafjXAXD5k1CUOAldmweyVv:Fp79cPNdVAoMIPof/s5ASQbltb
- TLSH
  T1CE74398E0DFF2721DEA999F2583381665BAFF9924428DDBE72F07048E91DC114DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32