Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svcc' = '%APPDATA%\AppNT\svcc.exe'
Modifies file system
Creates the following files
- %TEMP%\ns-fk07l.tmp\ns-o0n85.tmp
- %APPDATA%\appnt\msi.dll
- %APPDATA%\appnt\pukonielet8.bmp
- %APPDATA%\appnt\q5ngbi1cv.bat
- %APPDATA%\appnt\svcc.exe
- %APPDATA%\appnt\teamviewer.ini
- %APPDATA%\appnt\teamviewer_desktop.exe
- %APPDATA%\appnt\teamviewer_resource_en.dll
- %APPDATA%\appnt\teamviewer_staticres.dll
- %APPDATA%\appnt\tv_w32.dll
- %APPDATA%\appnt\tv_w32.exe
- %APPDATA%\appnt\tv_x64.dll
- %APPDATA%\appnt\tv_x64.exe
- %APPDATA%\appnt\vktgcm6xee.cfg
- %APPDATA%\appnt\x64\install.exe
- %APPDATA%\appnt\x64\teamviewervpn.cat
- %APPDATA%\appnt\x64\teamviewervpn.inf
- %APPDATA%\appnt\x64\teamviewervpn.sys
- %APPDATA%\appnt\x86\install.exe
- %APPDATA%\appnt\x86\teamviewervpn.cat
- %TEMP%\41co16i\x86\ns-alenj.tmp
- %APPDATA%\appnt\x86\teamviewervpn.inf
- %TEMP%\41co16i\x86\ns-g6bqr.tmp
- %TEMP%\41co16i\x86\ns-tf0p3.tmp
- %TEMP%\ns-qj4ie.tmp\_shfoldr.dll
- %TEMP%\ns-qj4ie.tmp\_iscrypt.dll
- %TEMP%\41co16i\ns-siiij.tmp
- %TEMP%\41co16i\ns-01rlj.tmp
- %TEMP%\41co16i\ns-qj0fr.tmp
- %TEMP%\41co16i\ns-3jlbe.tmp
- %TEMP%\41co16i\ns-vdlei.tmp
- %TEMP%\41co16i\ns-p2ksi.tmp
- %TEMP%\41co16i\ns-3gkpn.tmp
- %TEMP%\41co16i\ns-of9vq.tmp
- %TEMP%\41co16i\ns-j083h.tmp
- %TEMP%\41co16i\ns-tobga.tmp
- %TEMP%\41co16i\ns-t44je.tmp
- %TEMP%\41co16i\ns-9aijb.tmp
- %TEMP%\41co16i\ns-nsj46.tmp
- %TEMP%\41co16i\x64\ns-o92ei.tmp
- %TEMP%\41co16i\x64\ns-n1mhn.tmp
- %TEMP%\41co16i\x64\ns-bn8dp.tmp
- %TEMP%\41co16i\x64\ns-mrcn9.tmp
- %TEMP%\41co16i\x86\ns-u65tb.tmp
- %APPDATA%\appnt\x86\teamviewervpn.sys
Sets the 'hidden' attribute to the following files
- %APPDATA%\appnt\msi.dll
- %APPDATA%\appnt\svcc.exe
- %APPDATA%\appnt\teamviewer.ini
- %APPDATA%\appnt\teamviewer_desktop.exe
- %APPDATA%\appnt\teamviewer_resource_en.dll
- %APPDATA%\appnt\teamviewer_staticres.dll
- %APPDATA%\appnt\tv_w32.dll
- %APPDATA%\appnt\tv_w32.exe
- %APPDATA%\appnt\tv_x64.dll
- %APPDATA%\appnt\tv_x64.exe
Deletes the following files
- %TEMP%\ns-qj4ie.tmp\_iscrypt.dll
- %TEMP%\ns-qj4ie.tmp\_shfoldr.dll
- %TEMP%\ns-fk07l.tmp\ns-o0n85.tmp
- %TEMP%\41co16i\msi.dll
- %TEMP%\41co16i\svcc.exe
- %TEMP%\41co16i\tv_w32.dll
- %TEMP%\41co16i\tv_w32.exe
- %TEMP%\41co16i\tv_x64.dll
- %TEMP%\41co16i\tv_x64.exe
- %TEMP%\41co16i\x64\install.exe
- %TEMP%\41co16i\x86\install.exe
- %APPDATA%\appnt\pukonielet8.bmp
Moves the following files
- from %TEMP%\41co16i\ns-siiij.tmp to %TEMP%\41co16i\msi.dll
- from %TEMP%\41co16i\x86\ns-u65tb.tmp to %TEMP%\41co16i\x86\teamviewervpn.cat
- from %TEMP%\41co16i\x86\ns-tf0p3.tmp to %TEMP%\41co16i\x86\install.exe
- from %TEMP%\41co16i\x64\ns-mrcn9.tmp to %TEMP%\41co16i\x64\teamviewervpn.sys
- from %TEMP%\41co16i\x64\ns-bn8dp.tmp to %TEMP%\41co16i\x64\teamviewervpn.inf
- from %TEMP%\41co16i\x64\ns-n1mhn.tmp to %TEMP%\41co16i\x64\teamviewervpn.cat
- from %TEMP%\41co16i\x64\ns-o92ei.tmp to %TEMP%\41co16i\x64\install.exe
- from %TEMP%\41co16i\ns-nsj46.tmp to %TEMP%\41co16i\vktgcm6xee.cfg
- from %TEMP%\41co16i\ns-9aijb.tmp to %TEMP%\41co16i\tv_x64.exe
- from %TEMP%\41co16i\x86\ns-g6bqr.tmp to %TEMP%\41co16i\x86\teamviewervpn.inf
- from %TEMP%\41co16i\ns-t44je.tmp to %TEMP%\41co16i\tv_x64.dll
- from %TEMP%\41co16i\ns-j083h.tmp to %TEMP%\41co16i\tv_w32.dll
- from %TEMP%\41co16i\ns-of9vq.tmp to %TEMP%\41co16i\teamviewer_staticres.dll
- from %TEMP%\41co16i\ns-3gkpn.tmp to %TEMP%\41co16i\teamviewer_resource_en.dll
- from %TEMP%\41co16i\ns-p2ksi.tmp to %TEMP%\41co16i\teamviewer_desktop.exe
- from %TEMP%\41co16i\ns-vdlei.tmp to %TEMP%\41co16i\teamviewer.ini
- from %TEMP%\41co16i\ns-3jlbe.tmp to %TEMP%\41co16i\svcc.exe
- from %TEMP%\41co16i\ns-qj0fr.tmp to %TEMP%\41co16i\q5ngbi1cv.bat
- from %TEMP%\41co16i\ns-01rlj.tmp to %TEMP%\41co16i\pukonielet8.bmp
- from %TEMP%\41co16i\ns-tobga.tmp to %TEMP%\41co16i\tv_w32.exe
- from %TEMP%\41co16i\x86\ns-alenj.tmp to %TEMP%\41co16i\x86\teamviewervpn.sys
Network activity
TCP
HTTP GET requests
- http://ic####formation.com/ico/update.php?id#################################################
UDP
- DNS ASK pi###.#eamviewer.com
- DNS ASK ma#####.teamviewer.com
- DNS ASK cl####.teamviewer.com
- DNS ASK ic####formation.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'TeamViewer Manager'
Creates and executes the following
- '%TEMP%\ns-fk07l.tmp\ns-o0n85.tmp' /SL5 $5023E <Full path to file> 4417984 131584 /password=meoio7u /verysilent
- '%APPDATA%\appnt\svcc.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\41co16i\q5ngbi1cv.bat""' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\41co16i\q5ngbi1cv.bat""
- '%WINDIR%\syswow64\xcopy.exe' /Y /I /S "%TEMP%\41co16i\*" "%APPDATA%\AppNT\"
