Trojan.DownLoader33.23254

Technical Information

Modifies file system

Creates the following files

C:\tvp\autorun.inf
C:\tvp\teamviewer_resource_th.dll
C:\tvp\teamviewer_resource_tr.dll
C:\tvp\teamviewer_resource_uk.dll
C:\tvp\teamviewer_resource_vi.dll
C:\tvp\teamviewer_resource_zhcn.dll
C:\tvp\teamviewer_resource_zhtw.dll
C:\tvp\teamviewer_staticres.dll
C:\tvp\tv_w32.dll
C:\tvp\tv_w32.exe
C:\tvp\tv_x64.dll
C:\tvp\tv_x64.exe
C:\tvp\teamviewer_resource_sr.dll
C:\tvp\teamviewer_resource_sv.dll
%WINDIR%\temp\cab4f51.tmp
%WINDIR%\temp\tar4f83.tmp
%WINDIR%\temp\cab657d.tmp
%WINDIR%\temp\tar657e.tmp
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\temp\cab920d.tmp
%WINDIR%\temp\tar920e.tmp
%WINDIR%\temp\caba75c.tmp
%WINDIR%\temp\tara75d.tmp
%WINDIR%\temp\caba78d.tmp
%WINDIR%\temp\tara79d.tmp
%WINDIR%\temp\tar4f52.tmp
%WINDIR%\temp\cab4f82.tmp
C:\tvp\teamviewer_resource_sk.dll
C:\tvp\teamviewer_resource_ru.dll
C:\tvp\teamviewer_resource_ro.dll
C:\tvp\tv.ini
C:\tvp\teamviewer.exe
C:\tvp\teamviewer_desktop.exe
C:\tvp\teamviewer_note.exe
C:\tvp\teamviewer_resource_ar.dll
C:\tvp\teamviewer_resource_bg.dll
C:\tvp\teamviewer_resource_cs.dll
C:\tvp\teamviewer_resource_da.dll
C:\tvp\teamviewer_resource_de.dll
C:\tvp\teamviewer_resource_el.dll
C:\tvp\teamviewer_resource_en.dll
C:\tvp\teamviewer_resource_es.dll
C:\tvp\teamviewer.ini
C:\tvp\teamviewer_resource_fi.dll
C:\tvp\teamviewer_resource_he.dll
C:\tvp\teamviewer_resource_hr.dll
C:\tvp\teamviewer_resource_hu.dll
C:\tvp\teamviewer_resource_id.dll
C:\tvp\teamviewer_resource_it.dll
C:\tvp\teamviewer_resource_ja.dll
C:\tvp\teamviewer_resource_ko.dll
C:\tvp\teamviewer_resource_lt.dll
C:\tvp\teamviewer_resource_nl.dll
C:\tvp\teamviewer_resource_no.dll
C:\tvp\teamviewer_resource_pl.dll
C:\tvp\teamviewer_resource_pt.dll
C:\tvp\teamviewer_resource_fr.dll
%WINDIR%\temp\cabbcec.tmp
%WINDIR%\temp\tarbced.tmp

Deletes the following files

%WINDIR%\temp\cab4f51.tmp
%WINDIR%\temp\tar4f52.tmp
%WINDIR%\temp\cab4f82.tmp
%WINDIR%\temp\tar4f83.tmp
%WINDIR%\temp\cab657d.tmp
%WINDIR%\temp\tar657e.tmp
%WINDIR%\temp\cab920d.tmp
%WINDIR%\temp\tar920e.tmp
%WINDIR%\temp\caba75c.tmp
%WINDIR%\temp\tara75d.tmp
%WINDIR%\temp\caba78d.tmp
%WINDIR%\temp\tara79d.tmp
%WINDIR%\temp\cabbcec.tmp
%WINDIR%\temp\tarbced.tmp

Network activity

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'pi###.#eamviewer.com':5938

'ma#####3.teamviewer.com':5938

'CA#######X-R001.teamviewer.com':5938

'localhost':49180

'cl####.teamviewer.com':443

UDP

DNS ASK pi###.#eamviewer.com
DNS ASK ma#####3.teamviewer.com
DNS ASK CA#######X-R001.teamviewer.com
DNS ASK cl####.teamviewer.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'TeamViewer Manager'

Creates and executes the following

'C:\tvp\tv_x64.exe' --action hooks --deferlog --log %APPDATA%\TeamViewer\TeamViewer12_Logfile.log
'C:\tvp\tv_w32.exe' --action hooks --deferlog --log %APPDATA%\TeamViewer\TeamViewer12_Logfile.log
'C:\tvp\teamviewer.exe'
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TV.ini" xcopy /y "<Current directory>\TV.ini"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_zhTW.dll" xcopy /y "<Current directory>\TeamViewer_Resource_zhTW.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_zhCN.dll" xcopy /y "<Current directory>\TeamViewer_Resource_zhCN.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_vi.dll" xcopy /y "<Current directory>\TeamViewer_Resource_vi.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_uk.dll" xcopy /y "<Current directory>\TeamViewer_Resource_uk.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_tr.dll" xcopy /y "<Current directory>\TeamViewer_Resource_tr.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_lt.dll" xcopy /y "<Current directory>\TeamViewer_Resource_lt.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_no.dll" xcopy /y "<Current directory>\TeamViewer_Resource_no.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_sr.dll" xcopy /y "<Current directory>\TeamViewer_Resource_sr.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_sk.dll" xcopy /y "<Current directory>\TeamViewer_Resource_sk.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ru.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ru.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ro.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ro.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_pt.dll" xcopy /y "<Current directory>\TeamViewer_Resource_pt.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_pl.dll" xcopy /y "<Current directory>\TeamViewer_Resource_pl.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_th.dll" xcopy /y "<Current directory>\TeamViewer_Resource_th.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_nl.dll" xcopy /y "<Current directory>\TeamViewer_Resource_nl.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ko.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ko.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_bg.dll" xcopy /y "<Current directory>\TeamViewer_Resource_bg.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_cs.dll" xcopy /y "<Current directory>\TeamViewer_Resource_cs.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_da.dll" xcopy /y "<Current directory>\TeamViewer_Resource_da.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_de.dll" xcopy /y "<Current directory>\TeamViewer_Resource_de.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_el.dll" xcopy /y "<Current directory>\TeamViewer_Resource_el.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_en.dll" xcopy /y "<Current directory>\TeamViewer_Resource_en.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_es.dll" xcopy /y "<Current directory>\TeamViewer_Resource_es.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_sv.dll" xcopy /y "<Current directory>\TeamViewer_Resource_sv.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_fi.dll" xcopy /y "<Current directory>\TeamViewer_Resource_fi.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_he.dll" xcopy /y "<Current directory>\TeamViewer_Resource_he.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_hr.dll" xcopy /y "<Current directory>\TeamViewer_Resource_hr.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_hu.dll" xcopy /y "<Current directory>\TeamViewer_Resource_hu.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_id.dll" xcopy /y "<Current directory>\TeamViewer_Resource_id.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_it.dll" xcopy /y "<Current directory>\TeamViewer_Resource_it.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ja.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ja.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_fr.dll" xcopy /y "<Current directory>\TeamViewer_Resource_fr.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ar.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ar.dll"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ar.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ar.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_nl.dll" xcopy /y "<Current directory>\TeamViewer_Resource_nl.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_no.dll" xcopy /y "<Current directory>\TeamViewer_Resource_no.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_pl.dll" xcopy /y "<Current directory>\TeamViewer_Resource_pl.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_pt.dll" xcopy /y "<Current directory>\TeamViewer_Resource_pt.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ro.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ro.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ru.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ru.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_sr.dll" xcopy /y "<Current directory>\TeamViewer_Resource_sr.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_fi.dll" xcopy /y "<Current directory>\TeamViewer_Resource_fi.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_sv.dll" xcopy /y "<Current directory>\TeamViewer_Resource_sv.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_th.dll" xcopy /y "<Current directory>\TeamViewer_Resource_th.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_tr.dll" xcopy /y "<Current directory>\TeamViewer_Resource_tr.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_uk.dll" xcopy /y "<Current directory>\TeamViewer_Resource_uk.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_vi.dll" xcopy /y "<Current directory>\TeamViewer_Resource_vi.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_zhCN.dll" xcopy /y "<Current directory>\TeamViewer_Resource_zhCN.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_lt.dll" xcopy /y "<Current directory>\TeamViewer_Resource_lt.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ko.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ko.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_ja.dll" xcopy /y "<Current directory>\TeamViewer_Resource_ja.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_it.dll" xcopy /y "<Current directory>\TeamViewer_Resource_it.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_id.dll" xcopy /y "<Current directory>\TeamViewer_Resource_id.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_hu.dll" xcopy /y "<Current directory>\TeamViewer_Resource_hu.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_hr.dll" xcopy /y "<Current directory>\TeamViewer_Resource_hr.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_he.dll" xcopy /y "<Current directory>\TeamViewer_Resource_he.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_fr.dll" xcopy /y "<Current directory>\TeamViewer_Resource_fr.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_sk.dll" xcopy /y "<Current directory>\TeamViewer_Resource_sk.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_es.dll" xcopy /y "<Current directory>\TeamViewer_Resource_es.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_en.dll" xcopy /y "<Current directory>\TeamViewer_Resource_en.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_el.dll" xcopy /y "<Current directory>\TeamViewer_Resource_el.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_de.dll" xcopy /y "<Current directory>\TeamViewer_Resource_de.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_da.dll" xcopy /y "<Current directory>\TeamViewer_Resource_da.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_cs.dll" xcopy /y "<Current directory>\TeamViewer_Resource_cs.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_bg.dll" xcopy /y "<Current directory>\TeamViewer_Resource_bg.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TeamViewer_Resource_zhTW.dll" xcopy /y "<Current directory>\TeamViewer_Resource_zhTW.dll"
'%WINDIR%\syswow64\cmd.exe' /c If Exist "<Current directory>\TV.ini" xcopy /y "<Current directory>\TV.ini"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней