4501962efe237f55c88858106a5588e3ea9a259de8acda3b789e405a643fc507

Sharing

Copy URL Twitter E-mail

General

Target
Fernwartung_Retter-edv.exe
Size 20.7MB
Sample261110-pmqkcsfd46
SHA256 4501962efe237f55c88858106a5588e3ea9a259de8acda3b789e405a643fc507
MD5 9e1bfca05451d2ca565744e3ff833e7a
SHA1 3b82fe76def65b7b9e723b53176fae7f35ce8a56
SHA512 41d867e19803b719a647265900d9962c8f2eb5485f372e221268654a8bc811185ff59f665b7a6fe29989abb496671fb1340316c310c415a10f240b1f8df12e3c
SSDEEP 393216:T/c4LAtLw63KXk2wegS4fJlMdieYrkJ2bBv5gBTy:jc4LAt/32wegS4fggaJgt5eTy
TLSH
T1F22733F9E3E79A97F8326931D7951A35A5313ED450E52DF112CCB62C4A312DEE20A83C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Fernwartung_Retter-edv.exe
- Size 20.7MB
- SHA256 4501962efe237f55c88858106a5588e3ea9a259de8acda3b789e405a643fc507
- MD5 9e1bfca05451d2ca565744e3ff833e7a
- SHA1 3b82fe76def65b7b9e723b53176fae7f35ce8a56
- SHA512 41d867e19803b719a647265900d9962c8f2eb5485f372e221268654a8bc811185ff59f665b7a6fe29989abb496671fb1340316c310c415a10f240b1f8df12e3c
- SSDEEP 393216:T/c4LAtLw63KXk2wegS4fJlMdieYrkJ2bBv5gBTy:jc4LAt/32wegS4fggaJgt5eTy
- TLSH
  T1F22733F9E3E79A97F8326931D7951A35A5313ED450E52DF112CCB62C4A312DEE20A83C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CustomerTools.dll
- Size 831KB
- SHA256 a9f17262b3b4957e9efbf6ebe54400c7b7544e4fb40bf84753cd3bdb7053d035
- MD5 45943916ee7dc57cc14433a2a8bf6dc5
- SHA1 eb6bd53e304954051f02207a9db78d9e61cd97b7
- SHA512 a036fe7943a12f7956367265c6732c485f0f0b9ee964cc4ecceace46239ca019d05e37b8adb497e1dce36c468d45940f3c29f3b6c8f22abb4aac92b1f13321f8
- SSDEEP 24576:QIW/PvX0/qfjdiZ2dUktBe+63oEmV+oVQ/ngeKsS/D9:QLnvkCfa2dU6Be+63oRVJVSgeKscx
- TLSH
  T1FE055B307E19C136EAAB01F1AD3DAB6F416D6A550BF884C7A3C85B5E38745D22B37243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
- MD5 033ee34c40e8fa85bf2739bcb2f3e186
- SHA1 2ca942f35f77f37df3fc6097acac34f2e77341b7
- SHA512 2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
- SSDEEP 384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
- TLSH
  T1B1624D1137D558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
- MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
- SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
- SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
- SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
- TLSH
  T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 228KB
- SHA256 e721edb07e9a58dd696691d2492f1b3238974b35ae5401798b00c5a382d9ffbb
- MD5 de5041a1efd290a8bfc405f4a46168ff
- SHA1 4add2640ae5cc100769e604932ed1dd1e71f6608
- SHA512 dfa8f382ab2f922d9c01e5ef0dc7f0fc0e2fbd11ee131d03157d469bfbbda87b10c2d1cf0ad590e880a82ea7988354ffc19f6bd4ffa34254af502805a66f1190
- SSDEEP 3072:/E/4nvafk443LbdT30B9pRdySGnYmEegCtzII3VCclQIHr3K+Go:q4vI43dj0BTySBWjWwfXL3tGo
- TLSH
  T1B1345B1177E08839F6B71A306DF6C6604EB9BD326970D19FE790C91A2E70B85DB24327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 18KB
- SHA256 431fc2ed27d0b7a1ce80de07989595effcc3ffb1dea1af6c0e178b53f6bd2f1e
- MD5 e89c7cd9336d61bb500ac3e581601878
- SHA1 45b2563daa00ba1b747615c23c38ef04b95c5674
- SHA512 09485a354ac4ace6084cb6fcbd92eee8488074763c8443638f78e655e45e8aa0fe40a45d4ce0dff116ed3a4bb7bc4d7d845a6ccf0e0bf35533ce81626a8db06f
- SSDEEP 384:u1ju3wCtynlKEJAIl0CU4BNe0i5wsVEABy/7tpnYmdnDQVJlN/BmqIw4n:t3wCtynHJAIl0CU4K7yAB8tpVdDQJNI0
- TLSH
  T179821885657181F2F5B294F8B1613E132A7DFC121835E9EB0BF30B496864513BB2EB23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 175KB
- SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
- MD5 87853c0f20f065793bdc707ece66190b
- SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
- SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
- SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
- TLSH
  T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  TeamViewer.exe
- Size 40.5MB
- SHA256 08bfc729d0dca8f4a3bbbaa286a5d58f96fcd2061e518eab0456e1ef0e22f7e8
- MD5 50e2e9e2069a284590157cdf57e3c159
- SHA1 8772eb7e75188947f5665a7d07c5c5baecc5b7e3
- SHA512 2c9cfeeb9db1d77eb1b6a3384008b0c6c103cbe0bc84b7026839529f665f239ff0758a8d4cb09439e0cc7372f395a07a685ce539e25957073ba2f8290d0001c0
- SSDEEP 786432:pItGzntO/gO3Tp8gS7eaaGTt1aGKzGlKuC1Z/HXpXclBTgkd3RUnAf8KSi:OtGzntO/gO3TagSKa91a9zGlKuC1Z/Hk
- TLSH
  T17A976D217687C166E45F05B39A7D566AD22EED1707A400CB568CBDE93C34DC3BA32B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral15 behavioral16
- Target
  TeamViewer_Desktop.exe
- Size 10.7MB
- SHA256 7fa78e8de328bd6a973d9112c0088567b5b13b4ada0df7e1e8665fe5f6858128
- MD5 39c317f3dc09f7eb2f47fc7c69e49121
- SHA1 11150bf05d6d567537895cebd5b0797d7fea1009
- SHA512 1f91292e5cf50568eadb480fa70542b874a1d9a235af41bb7c2be3457c123ec23e70c4f363ef18c339c23d804547b6df0f38d6aa19f61f37c6d738441f84499c
- SSDEEP 98304:ZSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwn:I+ht3zCtQxqcwUYammtsY4tVRzbuNz
- TLSH
  T1ABB68E61F6D28122D59200B0DD2EA77A865C7D6807F180E7B3D8BADDB8712C37A31F56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  TeamViewer_Note.exe
- Size 569KB
- SHA256 3af7f4bfff991c301213d9f3e8d962fe51af46aaac492c9239f0b9bc488aa6fb
- MD5 ef7e948dd67c37b174e002001849c628
- SHA1 9f11b3efb5ec353eaa27642dd8d6e6e769c170db
- SHA512 f3a2db08366db18a7b78eb2f7f379505b645702efb59466d29d050c3dbdcb81c22af372c57185b91dac9cc29e074b6019a8733ffda57a30987bb9b34101c0576
- SSDEEP 12288:ol7Z4zvDLqyywvcXj7UDkmuuQmpEjXcz4:yqveBXjA9EjC4
- TLSH
  T1C5C4B4B0A292C163E423053DF651C6F7542BFEF4DAA038E756887E2BB9343C6852591F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  TeamViewer_Resource_ar.dll
- Size 339KB
- SHA256 a5788aceb3e8094694c631a7f2a91bc51823e4c2412a586ed0069dd19cf931f8
- MD5 c7a4e7de5a6d809c4c8b413447cad6c0
- SHA1 710f7b57ef965ea8c7ffe36b7e2d88cd9170e311
- SHA512 a91d073809b076109bd32018fa9f16fe41f52449daa021060a1826d836a52581015d339cea42565a335273b1ff4d0ca6ef6c7283350e124a642329bc176c7528
- SSDEEP 3072:oNhb6ITkUV/P6oCuUo+vBJH4lRwqflN6IOx3QjV:ozTV6QkYfflN6oV
- TLSH
  T11C74AB011E9CC23CF4A7A738C523C653526D656ADDEC723F47788A281AE44709B4F6F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  TeamViewer_Resource_bg.dll
- Size 398KB
- SHA256 47a8ac9d70d586f91a9c92e9ee064590782eaeebab6d7400ff4d3f32fcd26196
- MD5 93125561663751e06bea7c311300049c
- SHA1 6b1545a662fbc4a5bcd4d60cf9a45f590c666fd3
- SHA512 8de3b6d776179bff073764bc859c21d99485314d6a0a5b9ea94f14ce49a36d9fd964565d690ebf519b6063cf6653d28257e7b7f1c91d4a5f03580a23a3832bbc
- SSDEEP 3072:jNhTg9bT+NMbAfCbjr0fobY+Wf45LBolLDfJ5EhpexUjRauG/qHTPF:jVfFx/OHF
- TLSH
  T1B394310FB9BD9240FA69D3311F6646E721BA7B1073395ACA835F7D68602CA3137252C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TeamViewer_Resource_cs.dll
- Size 370KB
- SHA256 5f8dbf8d52b635df7d4f5f06f86982b7626da8fe5a0c45850d451f5b5a64dece
- MD5 85bf8f68574ce118d1932ed4852e5dcc
- SHA1 0f44f4f9e6776f32da4077671f60656c2bb0b9be
- SHA512 5f7ed5b4e4c84d154cf93cd8e336eb13db3a79ce6e8a541d945fce06acffc534640efca0dccd197246dfb298ddd940d3319b7764780b8305679ff0a147799932
- SSDEEP 3072:jNxqkkALKXmwnHqbaqOo/LbDustettIgNWP6ZLKVjMaWg5iCqVkZwb11UCKA6ndE:jU8NHUE1YsST/
- TLSH
  T1B584F30122FC0685F6FB6F76BDB406624E7B7CA2BA35C24F9550429D1D70AD0E8A5B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TeamViewer_Resource_da.dll
- Size 363KB
- SHA256 e38acb9a5b038661f0e58269a0bebc87bb94ffdca43d789c2848ab514f15850a
- MD5 a8a8a533f3dfd10522a3e8177bc46d62
- SHA1 3911d4a3b6169db98ed8542b87945478e1922a56
- SHA512 15f1b0ab98ea489f993b6d789d7e643f7b8eaea1744ecf3f561a105a8f566dd791890a8b63af004c99c8c27ec094b1330c3dc53c865f31e8cbc1fdcff9a14853
- SSDEEP 3072:SN4lBupUNPMfAWGZONCB5OC3Krnc0eq7HWanxMa+/CDC/iGTF/woucAQ3cGNteiK:SeQ2Cua4q
- TLSH
  T1AD84985123E95209F6F73F34BDB902945ABABCE6AD39D21D1210518D1CB2BE4D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TeamViewer_Resource_de.dll
- Size 408KB
- SHA256 28144ba475e7d89c01ff65ad8cbd5d0a5413d48087e44816a3d74ec04e270204
- MD5 ba498611e3fe3f37b85a8b8f9be25e7e
- SHA1 22f7362bdc8abc8cc4c7fc67199b4a3a17ef89ad
- SHA512 7a64e1dd9d2743e0afe085a9929d5d255beb475fe9ff73748ac096abef3134d4440277da388616993d9ef7f9ecd67ff42df2f0cffcad2b6436fec8e371141f0e
- SSDEEP 3072:dNX5nPNswdz4ZX57C0SPwqHyCumBtUOFXyzTF6yx11j1x9fuxMcKjXSynNCxPzmH:d0IGVkMtgS2BKp
- TLSH
  T1BD94DA1153E98618F2F37F74AEB863946EB2BCE6FD7AE54D1610509C1871A80DA70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  TeamViewer_Resource_el.dll
- Size 435KB
- SHA256 6258f162e976bbcf8eb77f4a7bed579580c7fbbc75576a44936f248b8f228f76
- MD5 e3a4fce469719321be089b83d023f5f3
- SHA1 35db74c78535a3c551549506e6a7c7385334685b
- SHA512 bc2c51df21757c771a174994e885a1641be1ca5f1beaecab19a725e957c154cdb0724a8e0d72fe354843d476656d7d35e131099293f55dc658427e4984bb86c5
- SSDEEP 3072:8N2/qZByTZkWwK/fgMtc4TKdXeKpl4bINU1HF78zocrJkdd2wNQbXFFQQfcCUOIx:8H/yQSwPNdVKMZaPtCbXQhjjkULB
- TLSH
  T1FA94168D0DFF2711EEEAA9F2583381565AAFF9924428DD7E72F03048E95DC118DC2E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32