Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\Media the Desktop 5.3982.lnk
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system:
Creates the following files:
- %TEMP%\XHbl\Teamviewer_Resource_fr.dll
- %TEMP%\XHbl\TV.dll
- %TEMP%\XHbl\TeamViewer.exe
- %TEMP%\XHbl\SujMaz.ico
- %TEMP%\XHbl\0.0
- %TEMP%\Cab1.tmp
- %APPDATA%\TeamViewer\TeamViewer5_Logfile.log
Deletes the following files:
- %TEMP%\Cab1.tmp
Network activity:
Connects to:
- 'wp#d':80
- 'crl.verisign.com':80
- 'csc3-2004-crl.verisign.com':80
- 'download.windowsupdate.com':80
- 'localhost':9998
- 'pi###.dyngate.com':5938
- 'ma#####2.teamviewer.com':80
- 'ma####.dyngate.com':80
- 'tr####orward.pro':80
- 'ma#####5.teamviewer.com':80
- 'ma#####1.teamviewer.com':80
- 'pi###.dyngate.com':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.verisign.com/pca3.crl
- http://CSC3-2004-crl.verisign.com/CSC3-2004.crl via csc3-2004-crl.verisign.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
- http://ma#####2.teamviewer.com/din.aspx?s=#####################################################
- http://ma####.dyngate.com/din.aspx?s=#####################################################
- http://ma#####5.teamviewer.com/din.aspx?s=#####################################################
- http://ma#####1.teamviewer.com/din.aspx?s=####################################################
- http://pi###.dyngate.com/din.aspx?s=####################################################
- http://pi###.dyngate.com/din.aspx?s=#####################################################
HTTP POST requests:
- http://tr####orward.pro/op/gate.php
UDP:
- DNS ASK wp#d
- DNS ASK crl.verisign.com
- DNS ASK csc3-2004-crl.verisign.com
- DNS ASK www.download.windowsupdate.com
- DNS ASK pi###.dyngate.com
- DNS ASK ma#####2.teamviewer.com
- DNS ASK ma####.dyngate.com
- DNS ASK ma#####.teamviewer.com
- DNS ASK tr####orward.pro
- DNS ASK ma#####0.teamviewer.com
- DNS ASK ma#####1.teamviewer.com
- DNS ASK ma#####3.teamviewer.com
- DNS ASK ma#####4.teamviewer.com
- DNS ASK ma#####5.teamviewer.com
- DNS ASK ma#####6.teamviewer.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following:
- '%TEMP%\XHbl\TeamViewer.exe'
