Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im teamviewer.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im teamviewer_service.exe
Modifies file system
Creates the following files
- C:\tvrepro30\killtv.bat
- %WINDIR%\temp\cab50d3.tmp
- %WINDIR%\temp\tar50d4.tmp
- %WINDIR%\temp\cab673c.tmp
- %WINDIR%\temp\tar673d.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\temp\cab9756.tmp
- %WINDIR%\temp\tar9757.tmp
- %WINDIR%\temp\cabac96.tmp
- %WINDIR%\temp\tarac97.tmp
- %WINDIR%\temp\cabacd6.tmp
- %WINDIR%\temp\taracd7.tmp
- %WINDIR%\temp\cabc225.tmp
- %WINDIR%\temp\tarc226.tmp
- %APPDATA%\teamviewer\teamviewer9_logfile.log
- %WINDIR%\temp\cabd34e.tmp
- %WINDIR%\temp\tard34f.tmp
- %WINDIR%\temp\cabe89d.tmp
- %WINDIR%\temp\tare89e.tmp
- %WINDIR%\temp\cabe8fd.tmp
- %WINDIR%\temp\tare8fe.tmp
- %WINDIR%\temp\tar5094.tmp
- %WINDIR%\temp\cabfe7b.tmp
- %WINDIR%\temp\cab5093.tmp
- %TEMP%\teamviewer\version9\x64\tvmonitor.sy_
- C:\tvrepro30\killtv.exe
- C:\tvrepro30\repro30.ico
- C:\tvrepro30\teamviewerqs_fr-idc6unhc4y.exe
- %TEMP%\bffb.tmp\killtv.bat
- %TEMP%\nstdab8.tmp
- %TEMP%\nsydb26.tmp\tvgetversion.dll
- %TEMP%\nsydb26.tmp\system.dll
- %TEMP%\teamviewer\version9\tvqsfiles.7z
- %TEMP%\nsydb26.tmp\nsis7z.dll
- %TEMP%\teamviewer\version9\teamviewer.exe
- %TEMP%\teamviewer\version9\teamviewer_desktop.exe
- %TEMP%\teamviewer\version9\teamviewer_service.exe
- %TEMP%\teamviewer\version9\tv_w32.exe
- %TEMP%\teamviewer\version9\tv_x64.exe
- %TEMP%\teamviewer\version9\teamviewer_resource_fr.dll
- %TEMP%\teamviewer\version9\teamviewer_staticres.dll
- %TEMP%\teamviewer\version9\tv_w32.dll
- %TEMP%\teamviewer\version9\tv_x64.dll
- %TEMP%\teamviewer\version9\tvqsfilesx64.7z
- %TEMP%\teamviewer\version9\x64\tvmonitor.cat
- %TEMP%\teamviewer\version9\x64\tvmonitor.inf
- %TEMP%\teamviewer\version9\tvinfo.ini
- %WINDIR%\temp\tarfe7c.tmp
Deletes the following files
- %TEMP%\teamviewer\version9\tvqsfiles.7z
- %WINDIR%\temp\tare8fe.tmp
- %WINDIR%\temp\cabe8fd.tmp
- %WINDIR%\temp\tare89e.tmp
- %WINDIR%\temp\cabe89d.tmp
- %WINDIR%\temp\tard34f.tmp
- %WINDIR%\temp\cabd34e.tmp
- %WINDIR%\temp\tarc226.tmp
- %WINDIR%\temp\cabc225.tmp
- %WINDIR%\temp\taracd7.tmp
- %WINDIR%\temp\cabacd6.tmp
- %WINDIR%\temp\tarac97.tmp
- %WINDIR%\temp\cabac96.tmp
- %WINDIR%\temp\tar9757.tmp
- %WINDIR%\temp\cab9756.tmp
- %WINDIR%\temp\tar673d.tmp
- %WINDIR%\temp\cab673c.tmp
- %WINDIR%\temp\tar50d4.tmp
- %WINDIR%\temp\cab50d3.tmp
- %WINDIR%\temp\tar5094.tmp
- %WINDIR%\temp\cab5093.tmp
- %TEMP%\bffb.tmp\killtv.bat
- %TEMP%\nsydb26.tmp\tvgetversion.dll
- %TEMP%\nsydb26.tmp\system.dll
- %TEMP%\nsydb26.tmp\nsis7z.dll
- %TEMP%\teamviewer\version9\tvqsfilesx64.7z
- %WINDIR%\temp\cabfe7b.tmp
- %WINDIR%\temp\tarfe7c.tmp
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK co#####l.teamviewer.com
- DNS ASK pi###.#eamviewer.com
- DNS ASK ma#####3.teamviewer.com
- DNS ASK cl####.teamviewer.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: 'TeamViewer Manager'
Creates and executes the following
- 'C:\tvrepro30\killtv.exe'
- 'C:\tvrepro30\teamviewerqs_fr-idc6unhc4y.exe'
- '%TEMP%\teamviewer\version9\teamviewer.exe' --configuration 6unhc4y
- '%TEMP%\teamviewer\version9\tv_w32.exe' --action hooks --log %APPDATA%\TeamViewer\TeamViewer9_Logfile.log
- '%TEMP%\teamviewer\version9\tv_x64.exe' --action hooks --log %APPDATA%\TeamViewer\TeamViewer9_Logfile.log
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\BFFB.tmp\Killtv.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\BFFB.tmp\Killtv.bat" "
