a7110efa88c0bf3b6b8afa34075b203efbe4f2e56323c3dfc7462c024a46b460

Sharing

Copy URL Twitter E-mail

General

Target
teamviewer.exe
Size 24.6MB
Sample260930-mvc8ws1cjd
SHA256 a7110efa88c0bf3b6b8afa34075b203efbe4f2e56323c3dfc7462c024a46b460
MD5 b65e9f2eef86ff6a2ada818ce4d5203a
SHA1 38a04b2b608efb6e0249056c9ca49de7147b9227
SHA512 7ba3a289169dc5faf80cdc252ec901b722b708225764f41397e692566f219b9e2dac38bc1b999a4cfa19460fd413b3e7ad6d925e0e50d5d282a7aba0574692ce
SSDEEP 393216:/3gPtAHpQPXZyO/Gvq1N1/XPnWo7m+PZhbDbeZJIXAWbsP9RVRiL1QpR9BTwEObr:/+iJwJPIQ1vff/PTbDOIw/P9zY1QzTc
TLSH
T1A44733E8E3E317DBF8325A71EB521238A5316DC468E45DA50BC8BB3C45752CE932AD1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  teamviewer.exe
- Size 24.6MB
- SHA256 a7110efa88c0bf3b6b8afa34075b203efbe4f2e56323c3dfc7462c024a46b460
- MD5 b65e9f2eef86ff6a2ada818ce4d5203a
- SHA1 38a04b2b608efb6e0249056c9ca49de7147b9227
- SHA512 7ba3a289169dc5faf80cdc252ec901b722b708225764f41397e692566f219b9e2dac38bc1b999a4cfa19460fd413b3e7ad6d925e0e50d5d282a7aba0574692ce
- SSDEEP 393216:/3gPtAHpQPXZyO/Gvq1N1/XPnWo7m+PZhbDbeZJIXAWbsP9RVRiL1QpR9BTwEObr:/+iJwJPIQ1vff/PTbDOIw/P9zY1QzTc
- TLSH
  T1A44733E8E3E317DBF8325A71EB521238A5316DC468E45DA50BC8BB3C45752CE932AD1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
- MD5 033ee34c40e8fa85bf2739bcb2f3e186
- SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
- SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
- SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
- TLSH
  T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- TLSH
  T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 222KB
- SHA256 c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e
- MD5 b9e0c430596b2435971079edd15d3f0c
- SHA1 fc214c6757e3539729e42f754c6b9768fd44a942
- SHA512 93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b
- SSDEEP 3072:DZiMB8EvkPz8LbdT3nB9pRdySGnXmEegCtzIItsYUl3UH4K+tv:NiMB8hz8djnBTySKWjW3tEYtR
- TLSH
  T1F0244B1177E0C439F6F71A34ADF6C6604EB9BC726970D18FA790891A2E70B85DB24327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  TeamViewer_Resource_nl.dll
- Size 422KB
- SHA256 c6a78b6f9120760845fcf08dfa368092f834f9895e6820dbb00078e0f3448ea2
- MD5 d73a7284f0e78165b2486367285c3081
- SHA1 3b47f76a8eb4864f38edb0b1429125660bae7ead
- SHA512 2df40e8709ccc6d4df1672826812c3f106a9128ba0084923f99d160614b21e78b34a3018d31adad55da5af6865a020a9f8c20710e2adae89701ca7ac3ae50006
- SSDEEP 3072:nbI97/EbVv8fpy5NsEUNw/rMegteH/QURrF6yWVYx9jUrptardGaT8FxaKTJvZbZ:/1Wh3kZNa2DmITG
- TLSH
  T12494BA5223F9920CF9F72F746DB922508EBABCE6AD75D68D0250219D5C71B809DB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  TeamViewer_Resource_no.dll
- Size 387KB
- SHA256 2930218d9a9286199676b9f9c97157920ab781bfaa9cb444860de636bd170859
- MD5 6a56c685fe9d917743348440a111901c
- SHA1 2d8a4077b98479a29f7b3de024d716117c2439c7
- SHA512 adc865cfe02b9d7ec3a33b3a040127765a1d0ef2548c1ecb018c2ae1ac9a5d6c48d8013fa9b25416cc476eb1d628f3b9b29094968dfcd3d226ef59830e0bc9de
- SSDEEP 3072:Ztkiq/qVsfX/bPJGQPo1vhctT/2fhzxA9elvbN5ZQNU/J2JZw19FlyhnEn0bgze9:wV1igz
- TLSH
  T12E84C95163F95209F2F76F30BDB812944ABABCE6BE38D21D1250519C4972BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  TeamViewer_Resource_pl.dll
- Size 423KB
- SHA256 1c4859f17e8fda279d34ea4c3afda7a7689194d1ddad7d0af13a5d950ae08f1a
- MD5 34112c0cae7159de6b06eeae24e1aafe
- SHA1 b0510454a9bad15ffbc2653742d1f2ef29bd177e
- SHA512 ccc2995bc1d22c71304f39d40db1937da81edbe89b57e2f3cc6a1705dacb850ea63eb4e24eff4ce68f2f1daa48a078147b3bf4bc45756f2bb06b4b2195dad9bf
- SSDEEP 3072:Kf7+QT21IPRJeznbx5kbZdLHyIsK1LuD4+P/MpEgqVypRs/WxO:AHtIKNuD42MsVP9
- TLSH
  T1F294140063F80655F6F76F74A9B976988E7BBD22BA38C2DF2510414D1A70AD4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  TeamViewer_Resource_pt.dll
- Size 416KB
- SHA256 9223d9fbc09aeb4987fe3453116d3891a64ddde2721856c9666cc91b2c420dcf
- MD5 7bcefd5024af7924a1d435c0148cb688
- SHA1 5e7aba9a9aefd92d0380c160e60421ab717208d0
- SHA512 f8d499aba6bec6f450f914fab6c333f4ad05ddc9565a9f690d202e07b2cbc4147950c849687c67405f4bcb11887e4992593698dbace3585525be3aff1a2cb97d
- SSDEEP 3072:n2J3/1YYpJijRlkBLlNR2OMgpELYfl9bHEEM/8xa:Gi4bRT43
- TLSH
  T13494435267FD1244FAF77F26AA7826258E7BBD92AC39C14D0120115A1DB1F80DDB8B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  TeamViewer_Resource_ro.dll
- Size 440KB
- SHA256 7bcb3684bb805932faa2af7a0858d7f198479fc5694eed6ae521926ff3c646af
- MD5 3e32f9ba1e3f61cd7c1f969108ae4de4
- SHA1 f0affd05f5a6aa2b7fa48620003edd06b710b531
- SHA512 b48ea945e6b85e8c50adeeb0aa493a68da5c6b8544b9f34aaa889c6c8fb6504fd636a609b8dd549f5d6957be020d94852cf8be0d1e4407b1eca53c01c99397c8
- SSDEEP 6144:ylPVXAavOri/5zxapeXmhiqT9zmZwcOHFRCC4qi3gXXjt93NlA8lwbI14IV9dqsC:Ldg
- TLSH
  T1B1A4865167F91205F7F3BF38A93826144E7B7EA7A939D54E1614018E0EB2EC49DA0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ru.dll
- Size 423KB
- SHA256 cc5982a6cebd310937b91a144e45c7a9271413c48ebe9bd5416d8499f7a360d2
- MD5 59d22fc83ddac6656ea15c39af750fc2
- SHA1 d19788d33e44da42c5b8c9e0a72214720a4ba185
- SHA512 ef05c221d77b14ff0502b912d7a0d8b4eaf156ffa48ace8646f006ffa75ad9a0d150ce6e91ffc9828be468d02a505bf69af94ce70116c0137b33135167d21d78
- SSDEEP 3072:W6OD8o2d4i/INBgWOHd2y5jsgj2eaqh/6y1wOSgX6IXvFTGMi+/afxB:XsXo6gZiL
- TLSH
  T14194860FFABC9590F9A9D3700F3289D710AABB50632995CE928F7D68602C63577253C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_sk.dll
- Size 409KB
- SHA256 3684e3718679505d7310db1ecfb209fdac4269c89deb1d569c44f19ad2731c12
- MD5 be5a8fad7e7a728fd79039d3d110079a
- SHA1 d605ced52146787c032ee85009362770bbf38403
- SHA512 991819e73a7140131549bed903079c65677e60bd7c7da97933e607bdbb7d646685edc535868c6b5e12ffc761664cf3a9063406d684e30624ea28f76f5ce95752
- SSDEEP 3072:AcJxZ+CzkliVLjg2VjcfO5Bi7ob9vQeLF4WxQbIr3S4WG/zNktc6RYqzDaY45lPS:dJmVVSEqhBrJE
- TLSH
  T17C94F02163FC0685F6F7BF75B9B401654EBB7CA6BE39C24E5650428D0D71AC0A8A0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_sr.dll
- Size 409KB
- SHA256 7f1c8fb07b0302a811a1dd8aaa7208a67d03af6fb89139604812b279992b943d
- MD5 41d9e5e101e978648c92980b036b7e76
- SHA1 0c84e846a6a0584991c3271a0316c5c611e7afd8
- SHA512 9ca12b845ab0c1f0990ac398c0e2b988d753dca4c0930bdd08a4f9663e87682124a8b01168877baeab9162c8f3da8dd0d6ecfc3e3d71b801bf23c368edf92f23
- SSDEEP 3072:J/J/i+AG69tuVAEAZcMMv4ZKU+0stvzNuVSm2/S5HOGch/cnfCW5AkAqx1od3lXl:HV8ev4ZdEzUVnD6kGfXpWIBX
- TLSH
  T11C94CD42A3FC2249F6F77F75AAB812650E7B7DB6BA39C15E1150028D0D71AC0D9A1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_sv.dll
- Size 389KB
- SHA256 3bf4d07265a5dcabb258482acb96efd0a58609d8c77aa534b17c189f881df757
- MD5 b15994726fbff8f868e184a052c3054f
- SHA1 5aea17125c2e8044a653aa706e8e11a61e205373
- SHA512 c937cefdbf63561c48c750d5607414aa6260bad9c8737bc79f92d81a79844d4e66521403bdb107aa238c1af0977293de7be0bb0b78df40dc9a06317692458e50
- SSDEEP 3072:z8x2k1/DX8qvRbADY1E47G97IFZjhUB2G7UwhBZabm46O51gaGPYV+tvHtVL3akJ:9kyr679Jhi8ch
- TLSH
  T18B840D4163ED5618FAF3AF74BDB8125049BABCE6ADBAD25D0A10019C0C71BD4D9B0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_th.dll
- Size 378KB
- SHA256 8306d5e32c39d7e9e85e8d779cccd971d2a7ae1331df95d988a7b5bb15737d72
- MD5 a1dfed454d1205640356a26dfd3493a4
- SHA1 a9aecd5e3096731e14363de5dd9fa890bca5c869
- SHA512 1444c5dd20b0942593a3d5acf03ae8e5c90eaa514a273ece25041c7e4f09994bba53d573dcdefe83a05a36d0171418b6640e3ccea9eb3fdddba5192398efe5f8
- SSDEEP 3072:mffvdPboG1dn8jw/O49eBhBS79p7dS1zFMniI3AeQyskb/bxn:CcGq/I3td
- TLSH
  T19084AC34A6F61302D597D1F0E6F11E727C28B902D46FC199C03BCA2955609BAABF4E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_tr.dll
- Size 395KB
- SHA256 e54a2765e291ea5439f50f32f7e27b866379718a8148d005a12647e6e258170a
- MD5 0efac4ef097b2bed59d1bb64a70b3d72
- SHA1 3e5b2b96c695c9793f17306c852a56425999e03f
- SHA512 f382844fd1ccae059c0114a7a00f2b349d6e10b0b33226981aa1843384303b6b9b0c6016e4f2387e1759233b42355c42f9460294507abe10945933c09f38a050
- SSDEEP 3072:fH992h5ooD6RrQrxO9VE2dLcyCpNvsnn+tJHfmklPoNArCsJIS8YEEiLh0xnQwo+:8LvsnYo8Olh93AzvyztE
- TLSH
  T1E1840E0043ED5A0AFAF32F357DB561910BAB7DB6BD39C25F2621215D0C71AE099A4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32