Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'msci' = '%APPDATA%\tzv7gci\msci.exe'
Modifies file system
Creates the following files
- %TEMP%\nsb566a.tmp
- %TEMP%\tzv7gci\tv_x64.exe
- %TEMP%\tzv7gci\tv_x64.dll
- %TEMP%\tzv7gci\tv_w32.exe
- %TEMP%\tzv7gci\tv_w32.dll
- %TEMP%\tzv7gci\teamviewer_resource_en.dll
- %TEMP%\tzv7gci\teamviewer_desktop.exe
- %TEMP%\tzv7gci\msci.exe
- %TEMP%\nsw569a.tmp\execcmd.dll
- %TEMP%\tzv7gci\avicap32.dll
- %TEMP%\tzv7gci\o7hn9tht.cfg
- %TEMP%\tzv7gci\fhqzbu1m.bat
- %TEMP%\tzv7gci\71vqg2i6x.bmp
- %TEMP%\nsw569a.tmp\nsis7z.dll
- %TEMP%\nsw569a.tmp\nsdialogs.dll
- %TEMP%\tzv7gci.bin
- %TEMP%\nsw569a.tmp\system.dll
- %TEMP%\tzv7gci\teamviewer.ini
- %APPDATA%\tzv7gci\o7hn9tht.cfg
Deletes the following files
- %TEMP%\tzv7gci.bin
- %TEMP%\nsw569a.tmp\execcmd.dll
- %TEMP%\nsw569a.tmp\nsdialogs.dll
- %TEMP%\nsw569a.tmp\nsis7z.dll
- %TEMP%\nsw569a.tmp\system.dll
Modifies the following files
- C:\system volume information\syscache.hve.log1
- C:\system volume information\syscache.hve
Network activity
Connects to
- 'localhost':49177
- 'pi###.#eamviewer.com':5938
- 'ma#####0.teamviewer.com':5938
- '21#.#27.163.137':5938
- 'bi###roll17.net':80
TCP
HTTP GET requests
- http://bi###roll17.net/update.php?id################################################
- http://bi###roll17.net/update.php?id######################################################
Other
- 'localhost':49177
- 'pi###.#eamviewer.com':5938
- 'ma#####0.teamviewer.com':5938
- '21#.#27.163.137':5938
UDP
- DNS ASK pi###.#eamviewer.com
- DNS ASK ma#####0.teamviewer.com
- DNS ASK bi###roll17.net
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: 'TeamViewer Manager'
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C "%APPDATA%\tzv7gci\fhqzbu1m.bat"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "msci" /t REG_SZ /F /D "%APPDATA%\tzv7gci\msci.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C "%APPDATA%\tzv7gci\fhqzbu1m.bat"
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "msci" /t REG_SZ /F /D "%APPDATA%\tzv7gci\msci.exe"
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "msci" /t REG_SZ /F /D "%APPDATA%\tzv7gci\msci.exe"
