7c8eaabfd0090fae790b97cfc8659d1084f6214ddbf9e814fdcb90af313dd447

Sharing

Copy URL Twitter E-mail

General

Target
incoSAT.exe
Size 29.4MB
Sample260930-w3dztsybph
SHA256 7c8eaabfd0090fae790b97cfc8659d1084f6214ddbf9e814fdcb90af313dd447
MD5 ed76e753ffbdbc3ac4bf4232fba1ac1f
SHA1 caf4267ef1d6b402c5eba05727d3656850330909
SHA512 54530e3f00ebe03f3e84aecb39e7598cfff9b6df5ec5929a1af1187278435fa1cedc2575867b9fdad25b6a73bd9f5255498b08177efe23cea33b9fe1bbde1f70
SSDEEP 786432:RG7G5y+Zbpuu/DhP51wSk5ETrfOpplUuyRfY4J:RHzh5140rmpplGJ
TLSH
T13D6733361C459C97E407BCB7FCB85907D23F9E5836501A234E6035B89F39BC27A2929B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  incoSAT.exe
- Size 29.4MB
- SHA256 7c8eaabfd0090fae790b97cfc8659d1084f6214ddbf9e814fdcb90af313dd447
- MD5 ed76e753ffbdbc3ac4bf4232fba1ac1f
- SHA1 caf4267ef1d6b402c5eba05727d3656850330909
- SHA512 54530e3f00ebe03f3e84aecb39e7598cfff9b6df5ec5929a1af1187278435fa1cedc2575867b9fdad25b6a73bd9f5255498b08177efe23cea33b9fe1bbde1f70
- SSDEEP 786432:RG7G5y+Zbpuu/DhP51wSk5ETrfOpplUuyRfY4J:RHzh5140rmpplGJ
- TLSH
  T13D6733361C459C97E407BCB7FCB85907D23F9E5836501A234E6035B89F39BC27A2929B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 1001KB
- SHA256 3053b06883b8bd56d9a961f44cd67ca7b34ff85eb59ca1c116af0c6ba4c387e6
- MD5 dfce06caf5f4d2421a42d8725d729cfb
- SHA1 8f59c983cb60bbc49f2b44cfe672de08c0491dc8
- SHA512 0600e588c2fb95592acd627ca97942fad3075d9169a79ff3ca8096fd743286b52694f57323dce0f4af2babbc5fff7ba43321f6c90a56d2b58c4e6b0f3b99d196
- SSDEEP 12288:E34fnIsCz0pL5gtBhJHmtkSJ8cfRrqi3ApzINsjCTEjz7k/q:XfL00+3JGqlxCsKEjzR
- TLSH
  T17C259E217509C035E9AE11B16C3DAB9E819D5D2B0B7044CBE7D86E6EB9340E37B32B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH
  T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 30KB
- SHA256 018cba12efaab3ec61cfa2c54772f0e070452d57f2fc71026826fd7e3f59bd39
- MD5 bcb13343ab422d2c7ce98e324bd02c8b
- SHA1 b6e633426c0d9f3d1f2ef0cf4a27218974da1f7f
- SHA512 dfa02415b6c2003eae5b19f49726536d023bf72dc1e4f123906c1e2fe6200473db8e674e94947f6e07f8cda9e0bbe28cab968225968ee832b8e4bfc5997240b7
- SSDEEP 768:V3wCtynHJAIl0CU4K7yAB8tpVdDQJNILw7/YiW+LZPxWEJY:ttypAY0WqVB8tpVdDQJNI07/7LPxA
- TLSH
  T182D26A66897048B1F97788B4B1E03E232A7DFD0258A0D5E713EB86055A603437B7E73B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH
  T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 60.9MB
- SHA256 3869bb02b3565a51895f52de6894181cb4aef2cbe24f8e16b94ee2d1bc0c00e6
- MD5 db814359a1b2b7f131cb0e577a9e07a5
- SHA1 3168385bd78c3ee3cf348853b056e0055f15d16b
- SHA512 37eadb04a10e931586971a4c4d485e8bd13b24d44fe00fd24b1ea07901e33ddd038284cbcc82f0f4844cf2f78b899efd5eab539d83ad3cb982a59c8244c39f7b
- SSDEEP 1572864:Fc0l6Qmh91tTBNo4280uItO7d/HDIGq36KbR3sRTuA7Me09WO:F4E6n0
- TLSH
  T151E77C3071C98021D587C1B1E56C677A962E9E22476CC0CFD2D4FA7EF9634C32A36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 13.1MB
- SHA256 2d94d6e0adaef61193849e8f2726c87274ffab31defb48452520f14fd52cc34a
- MD5 f11beda756397572856c9ce60ba0d874
- SHA1 d9bc2f5c5296cbc2be2008d8a400b35bc840cda3
- SHA512 265e3f97db8fa14ec40a977d4897a36a75214534b882e604dc4a9b9aff814f59397838dbfdfdcd397bd368a32bffedd246bcb2bfb4b5ded29b2b6331fbd4f1f3
- SSDEEP 196608:Eu5/rev28l2kSn3BkQgdvcuiwVcEi9dqrmftd+7NA9BVFVm:HYfl2pnxkQWv3iECrdCNA9B
- TLSH
  T15AD68F11B1468471D18B12B1CD2FAB7A8738ED2907F184F7A2D4ADE979706C23B71B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 560KB
- SHA256 c053d2422f243389dd3e951036ac9bf00dc3c46afde986996fc846622fd1d08f
- MD5 27217c89e728869dd1392f928e907454
- SHA1 70074bfabda015e2cd3f0c7a89f49813ab759eec
- SHA512 099ea86e217563d89e13cddbe9f774e49c2b58c7c8af762ac6728a2dc2ace717795f650b98a690049d92ab3c4f4db77c56c8d1ee35e8b6bb981173ea1b9bddd5
- SSDEEP 6144:FYCcPGjFOvO0mzWKhyfczrtvhau3piyYa/7HZJdhgPmyVvkX:FYCcPGjB0iThy6hasZ51OBvkX
- TLSH
  T114C4F4707DD5C463E4528DB1F92996FFC629AD31FA18448B7EC03E2AB970381BE31A15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 364KB
- SHA256 aa828ea68e1668f44c4aae06a51406537328572e997302a3a9ef9e0bc790f92b
- MD5 9635a708f4839b64831e51910d0a3b90
- SHA1 c34e84d45a99e3ff3a8648cab9276796d8ea5ed1
- SHA512 dd0ea6ca0867c8a6f995389125948fc6c2d249212e566947c1e15e77f3e358785bbf10ae75b1d224ee0ce49c7d746829f155ddec10cbf4a8b8b3f09ae75e191d
- SSDEEP 3072:7VyZBFxTDhsPuyLQoH1+sU/+5jHJxy3Yl8BOCLypYlF66SAK/:7kxTKuy7+AyOCWYlF6z
- TLSH
  T14184BA011E9CC23CF4A7A738C923C653526D656BDDED723F46388A281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 428KB
- SHA256 f8b53435f875fa370e630f99e04cab45deec510c13f79cca6df00643ffc7505f
- MD5 3c71cce240e36bdf5e30116c812b6483
- SHA1 2905cea7cfc79995096730b89b6164835a33dd50
- SHA512 f1e8c6cd081b550ae1cedf44f8303884111f609bea3da84930ada280771824b014ab01f733f74dad00ac4352a903529dd4c8049aa75785ccab95d49c662cf869
- SSDEEP 3072:GVMjFbiPqZ92sPeDZpRTwZr0fg9BbYoypv59BoliII7psM8h/5YxhdqpCZtrRa6h:GuziIRWPpb
- TLSH
  T11B94420FB9BD9240FA69D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 399KB
- SHA256 2c2333d16f827b0c7dde0611fc6e2c38326be8891833b9fe9d84d27d5811ae00
- MD5 a1316bbefea96bef0b486d4ef25e8196
- SHA1 8b157632361fe6167776df20ccccd12b1dfe917d
- SHA512 73e41ce4ddfe667056375c4c7873035b109663522d024d0a6a9a08fcf5c81f26d54764cc492eeb33ac6fa0a0126c439dbdb62f09730941dfc53322e027e95ce0
- SSDEEP 3072:/VS5kkALenmGn5ea0slL/LbDWsQOBMKBtQA3LP6ZLRxjMaWg5iCFAVgZCx1zoUPQ:/VOuI2MS6m4tQuaUz7Vrbt2S0nrl
- TLSH
  T17094F30122FC0685F6FBAF76ADB406624E7B7CA2BE35C14F9550429D1D70AC0E8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 393KB
- SHA256 807620b311d0645350e096ab32917eca6172c14c65b23646d540661a89f16c95
- MD5 a337d565b679199be4c982e482df52f2
- SHA1 cdf3717a7a420a3af5bdaec0c9dcfdc7e289cc0f
- SHA512 89c19696dd98f9ebf46eecff70bc53d7662cd251d9bf4fc7a9bb82f17af256e6c567d5bb5d8f3644a33710497d4536bc7c5ab3e255ff1c0be17f3f10abfd09ff
- SSDEEP 3072:ibEps7WpUSPql7P07PsWIZO5Cv5OlujOmnc0cd7xeDzM0+/CDxdc8JfR/k1cfwN3:ig4sOsSJ4
- TLSH
  T11984975123E95609F6F73F34BDB902945ABABCDAAD39D21D1210509D0CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 440KB
- SHA256 6f39b31791980818302c5d6cdf20d26502ff25af83646f683ac1cc1aa8a9f4aa
- MD5 39ff194c3c03738838f6f7a8f99286cf
- SHA1 fa8aea658c4835e283f4d04d1a65c9ad617780bd
- SHA512 ced7df2eb92ba795b50174eeb1ef9625415339dd6e39045dd2bfcd35187a1b01b15f5fedf141e69c97d1b40130c111276be5c124baa0d591863cdf29af2504aa
- SSDEEP 3072:plazVPM1HDB74Zp0Fk0L0C0lpiVCuuY15XyzTFPT8y1OWZ1Kofx9quxM8lsKjSCn:plaTD/RDWtN3PUHrT
- TLSH
  T161A4EB6153E98618F2F37F34AEB862946EB2BCE6FD79E54D1710509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 467KB
- SHA256 6d8162f21d3bb8c57a777f747e3523c5628854226679aa62ad657a710b4e7b92
- MD5 feb5c02d6cd4e1232560ccca4214e38d
- SHA1 528f019261a552e260ffab4ee95b6bf81d5397fc
- SHA512 24a1db35c5ce76bf86f0d7359710174c5d6da0e80a4b77207bcb724e25b439ef6a7927cde2de8241b1b1075ea42c25c28d59da63d20d610c976f7d7475aeb49b
- SSDEEP 3072:nCF5zZk1SKMw87TFnb1Kpl4nXIN5Gt5F78zocrJkdd2wdfafa+TAXp6Q+CUOPldi:niTngjb/jPNdVaMpaLScBGZJUppvAhN
- TLSH
  T125A4278D0DFF2711EEE6A9F2583381565AAFF9924828DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32