c1a31b150919153fa1534b4be0e72994fe7d9486d619339dfaa1e6edc6612e92

Sharing

Copy URL Twitter E-mail

General

Target
TeamViewerQS.exe
Size 17.7MB
Sample261102-pl9xlsb18k
SHA256 c1a31b150919153fa1534b4be0e72994fe7d9486d619339dfaa1e6edc6612e92
MD5 bdb5e43b1b90b3e17ff5a4b148a4c9cc
SHA1 1043b228d98cbb16ae845679f855408b8d94e339
SHA512 ab993c6497c63f4f120dba3d0a6f076cdacadba62b15812db5221798227860d09f64b39fa75b5ef35ed52187326de71cdb5a2006fc3c009a4d93fe2edd1c2ff4
SSDEEP 393216:LsqMHdryVtE+hVJD0NeGueza5VP/yzyipWqN4ehqYiResTI:gqMI2+vJfGDi/yz7sqN3azI
TLSH
T1461733E9D3F617A7E8315A36DB91523865327EC560E92DF116C4772C8E310CEA31BA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  TeamViewerQS.exe
- Size 17.7MB
- SHA256 c1a31b150919153fa1534b4be0e72994fe7d9486d619339dfaa1e6edc6612e92
- MD5 bdb5e43b1b90b3e17ff5a4b148a4c9cc
- SHA1 1043b228d98cbb16ae845679f855408b8d94e339
- SHA512 ab993c6497c63f4f120dba3d0a6f076cdacadba62b15812db5221798227860d09f64b39fa75b5ef35ed52187326de71cdb5a2006fc3c009a4d93fe2edd1c2ff4
- SSDEEP 393216:LsqMHdryVtE+hVJD0NeGueza5VP/yzyipWqN4ehqYiResTI:gqMI2+vJfGDi/yz7sqN3azI
- TLSH
  T1461733E9D3F617A7E8315A36DB91523865327EC560E92DF116C4772C8E310CEA31BA2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 831KB
- SHA256 a9f17262b3b4957e9efbf6ebe54400c7b7544e4fb40bf84753cd3bdb7053d035
- MD5 45943916ee7dc57cc14433a2a8bf6dc5
- SHA1 eb6bd53e304954051f02207a9db78d9e61cd97b7
- SHA512 a036fe7943a12f7956367265c6732c485f0f0b9ee964cc4ecceace46239ca019d05e37b8adb497e1dce36c468d45940f3c29f3b6c8f22abb4aac92b1f13321f8
- SSDEEP 24576:QIW/PvX0/qfjdiZ2dUktBe+63oEmV+oVQ/ngeKsS/D9:QLnvkCfa2dU6Be+63oRVJVSgeKscx
- TLSH
  T1FE055B307E19C136EAAB01F1AD3DAB6F416D6A550BF884C7A3C85B5E38745D22B37243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
- MD5 033ee34c40e8fa85bf2739bcb2f3e186
- SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
- SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
- SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
- TLSH
  T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- TLSH
  T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 210KB
- SHA256 c67cbd5e35e1ce0c7ba17c55d8e2bc33afd5e0a68774554a1fe7216d330c709e
- MD5 05f51bc8ffb2c8f5a2825bf5680301cf
- SHA1 30f7f77dce1fb3526142780e9f5bd5c11622d6b6
- SHA512 1e041aaa37dd00414ad955ebc8c0f708589014d2085a5a0b95a31f4d694bb1cc4994bb1324d4b983cbad0449fb0a05560d82c60fdbfc78be67ff61275e451233
- SSDEEP 3072:4J7KJkcma0VkpOG/374vnriZ1nmTaK405/+ncMCQ2bDh:6EkcmYOG/37MnGZoeKxpuuQ
- TLSH
  T1D7245B0177E4843AF2F726746DF6C6604EBDBC725934D18FE780892A2E70A85DB24727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 18KB
- SHA256 431fc2ed27d0b7a1ce80de07989595effcc3ffb1dea1af6c0e178b53f6bd2f1e
- MD5 e89c7cd9336d61bb500ac3e581601878
- SHA1 45b2563daa00ba1b747615c23c38ef04b95c5674
- SHA512 09485a354ac4ace6084cb6fcbd92eee8488074763c8443638f78e655e45e8aa0fe40a45d4ce0dff116ed3a4bb7bc4d7d845a6ccf0e0bf35533ce81626a8db06f
- SSDEEP 384:u1ju3wCtynlKEJAIl0CU4BNe0i5wsVEABy/7tpnYmdnDQVJlN/BmqIw4n:t3wCtynHJAIl0CU4K7yAB8tpVdDQJNI0
- TLSH
  T179821885657181F2F5B294F8B1613E132A7DFC121835E9EB0BF30B496864513BB2EB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 35.3MB
- SHA256 1ca5a30044714662d21622dd62fbb0dcefc81266d5d320408fa6258cfc4d8252
- MD5 ca9695f942cb9f6be31315fe1825b972
- SHA1 ee2c57a83a876f2ae735aedf64f04e4d373057a0
- SHA512 f8aeda3f717b741cb1655daf395a4215480141d439afd1c68415ec04dda29d99088bfc708acb6b0a5676020a75ac1f05691abf1f61283a874f48176dc557fa48
- SSDEEP 786432:h8tGzntV1/uI1BbOhBLHyyT+yN8/xiEMdme8o4Dh3ToM3tZhafTj0RUXk:2tGzntV12I1Bb6BLS4is8o4BoM3NUU
- TLSH
  T12A876D61B6CB8159D45601F24B7D6B9F823CEE19877404D7D2D8B67BB830CD22B32B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 9.7MB
- SHA256 6169fe8fbec2e4807584d2282acd8012c490f9adf2120263bed3853a7fff120a
- MD5 912ce9c56ecf2bc3b0134247c1cdc2dd
- SHA1 0004b56d844b73df82a8dd1dde0b93fb3d185af7
- SHA512 093e0cc71e141a3abea1c2ce512006d38c42343f6e511f497c82393eca4b62232abb43f6e2f6f48098c10d980d9cf556e583e9246d378ea1b281bbee043c8216
- SSDEEP 196608:32t3zCtfZKIpCRXGWjtuRZW2P9CjxpI6E+f:32t3zCtgIpsXGWjIrnCVph5f
- TLSH
  T146A68F60F6D3C1A6D95604B1853EAF6F941DFE6A0B1080EB92D8BF1DA8307C31A71F56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 1.3MB
- SHA256 def9c475e6faf10d0f94958f627d514807debba5ac1f6c6a6ff42e2f61e8e2e5
- MD5 57090ebee53deb5280b24b7ab0aa7cce
- SHA1 ca5b5a1fcd5d3826de227df5945ae501e316501f
- SHA512 f2d6b151e7d911276e999e7c49be92eff0722489e1d7fa51a10f85d9dc32727700850f7d000e0499f6f529f426932b47034262f62235bc64f48fb9e07609e299
- SSDEEP 24576:qozKtITAo/7XihOkNmGWfRK+xCHHZZZTkDq7vJHay/3O:0QShLNpWoRHHZZZTkDq7vhaue
- TLSH
  T12C5539B17242D623D463007CED65D6F6106BFDB8CB6594EB62C87E2E39303C12A3596B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 277KB
- SHA256 bc406661cef10489a975e48f367f4cd78615eacb654d44b60691ad82a3f3385b
- MD5 e3f61a30c9e45912593936eba5405a55
- SHA1 7f894b62a01e4de8049b1c07733001f1bf26ce19
- SHA512 b8935b26fd55a5d0a39890dd899a1d2fd49d442c365dd0283cd413217113948a5e99540cbd26cef01b27b4c0bc10e94c8410d95dc0d940a8d88d259b7d2f370a
- SSDEEP 3072:yD6TW10xNWfPmxwDNJ+7lwc4l861EI1wh:fTee+O4l86oh
- TLSH
  T1A45499011E9CC23CF4A79738C523C65362AD65ABDDDD323F46788A281AE44709B4FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 325KB
- SHA256 6e918e90f7b57909b089d147d075e2e5f2a5075ed51562179fe7c5ae47c1181a
- MD5 f0860dbcdb4fe4a678ad16f7e0e9f852
- SHA1 e56cc4b93fa538c6b85c6115366dab0ccbe03d95
- SHA512 e7604e319eefe9ad8e34f05df67939f8341c5f3aa13b72d56df4da365139dc41d7ba2809642cef632597258e7c145387d52f8506f0eda2b672c478f0b7456e52
- SSDEEP 3072:tLuT9b2EoXNBmqK1kDrJfi78y7Ff35oBols2GyequpArxRa6yGQ:tyWnMlQ
- TLSH
  T1F064310FB9BD9240FA59D3311F6686E721BA7B1073395ACA835F7D68602CA3533252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 302KB
- SHA256 f703ed5b4188adbcf6797c6b2abc0c5981ba6669bd5be43761ec99d429eb28e7
- MD5 469950d045fd3e729e1253c236e66b7b
- SHA1 4c93eb2ee232d97af71e53664a5ae14bbd90cf23
- SHA512 75f3b7a9a40fe1844f380b14ea0a8ff1a34d3ac228e2204bfde75e2a25c06878f20e17cbb239f3cad00ace3f3414315c7d69fdd5624f3583cf66ee4298a34efd
- SSDEEP 3072:Nnkkv5mEnHqba+Doq6NWP6ZL/jOrZaWg5iCCVkZwQ4GVAkvL39Qdesvywmne9mX2:tBVQYQfUcT
- TLSH
  T10564F20122FC0685F6F7AF76BDB406624E7B7CA2BA35C24F9550428D1D70AD0E8A5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 298KB
- SHA256 bbea8e3b287890722fece49d4e34116709ad6c107f5d5896df2d86ca22942654
- MD5 7918b2dbd6b61f4cc3f708d5ce0dde22
- SHA1 fb7d8b0ae3a2942d973a399b693fc5b107a5a515
- SHA512 8c727d6215d17139fbb341023f870d9a824a073b2e88a4715e2feda5926941f2cf403ff353ab203f5b4212172e3dd6a1114424c7bda26f87445a9e644fd32499
- SSDEEP 3072:lBJnCp6/PMfMWgZ7CX5OSyZ4Voa7ZRa9x3+/CDH/ybluQoc+PD1cGarepGDqXUgn:Dcgiun
- TLSH
  T1CE54985163E9520DF6F73B34BDB902945ABABCD6AE39D21D1210518C1CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 335KB
- SHA256 50604bb7924c7859dea72596675f838200d0b8348ed5e61f8e26d905612c42af
- MD5 3abf525309734618f1a49c530615728d
- SHA1 fcfbcab486d8bcf5541d002bfa15b7c45e4468bf
- SHA512 77d60dc1837690395d87bf89fd215ff5c896ad0e8eb223d60488542d03ca62ef6d5e08ac9a8172180bef082501f481b5b8bb0e6e809acb5ce1ccc054252708e5
- SSDEEP 3072:8bPbjxz4ZeOluqv9Cu+ctU0QXQzEdvgpS141XLxuwMPKjJSPnAPdcvmoWQPnD7Yh:JGY4WtrgjTI
- TLSH
  T12E74DA1157E98A18F2F33F74AEB862946E72BCE6FD7AE54D1710509C1871B80DA60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 360KB
- SHA256 3d2e2cc0c0fcc70105f25f42faabc4e059e4ed0b0a048b7d6749f1c38e8ecf71
- MD5 7fa8a1df1408091532afcf9a86992386
- SHA1 feab2263bd355e82990064764df2cf212edb0c58
- SHA512 35023594179e026cd5e442cbd76612aae21718e90b01d1ab5ab3d722da96205dd40509aee0bffef0f3b12694b9803aae4c963828d80d7e4d5717a215c1f9403c
- SSDEEP 3072:/m1y6P+Zk1JbK/V2ITKdMiHKYl4LINfvuF78+oc2kdd2wMhbXI0AKEgCUdcldowd:YTzVygPNlVBnWLh541eTxQc0u9
- TLSH
  T16D74388E0DFF2711DEEA99F2583381665AAFF9924428DD7E72F07048E91DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32