Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\teamviewer8\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" %1'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\TeamViewer] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\TeamViewer] 'ImagePath' = '"%ProgramFiles%\TeamViewer\TeamViewer_Service.exe"'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\TeamViewer\TeamViewer.exe' = '%ProgramFiles%\TeamVi...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\TeamViewer\TeamViewer_Service.exe' = '%ProgramFiles...
Modifies file system
Creates the following files
- %TEMP%\nsa2.tmp
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer.gpd
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvpsprint.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvprint.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.cat
- %ProgramFiles%\teamviewer\tvextracttemp\tvfilesx86.7z
- %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ro.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_staticres.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhcn.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_vi.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_uk.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_tr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_th.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sv.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sk.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhtw.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ru.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.inf
- %ProgramFiles%\teamviewer\i386\teamviewer.gpd
- %WINDIR%\fonts\teamviewer10host.otf
- %APPDATA%\teamviewer\teamviewer10_logfile.log
- %TEMP%\nsi3.tmp\ns6.tmp
- %TEMP%\nsi3.tmp\ns5.tmp
- %ALLUSERSPROFILE%\start menu\programs\teamviewer 10\license.lnk
- %ALLUSERSPROFILE%\start menu\programs\teamviewer 10\teamviewer 10 host.lnk
- %ALLUSERSPROFILE%\start menu\programs\teamviewer 10\uninstall teamviewer 10 host.lnk
- %ALLUSERSPROFILE%\desktop\teamviewer 10 host.lnk
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.inf
- %ProgramFiles%\teamviewer\tvextracttemp\w2k\teamviewervpn.inf
- %TEMP%\nsi3.tmp\findprocdll.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer_printprocessor.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\w2k\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer.ppd
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvpsprint.inf
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvprint.inf
- %ProgramFiles%\teamviewer\i386\teamviewer.ppd
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pt.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pl.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_no.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer10host.otf
- %ProgramFiles%\teamviewer\tvextracttemp\lizenz_teamviewer_en_unicode.txt
- %ProgramFiles%\teamviewer\tvextracttemp\lizenz_teamviewer_de_unicode.txt
- %ProgramFiles%\teamviewer\tvextracttemp\copyrights_en.txt
- %ProgramFiles%\teamviewer\tvextracttemp\copyrights_de.txt
- %TEMP%\nsi3.tmp\nsis7z.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_service.exe
- %ProgramFiles%\teamviewer\tvextracttemp\tvfiles.7z
- %TEMP%\nsi3.tmp\tvproc.dll
- %TEMP%\nsi3.tmp\tvupdateinfo.exe
- %TEMP%\teamviewer\tv10install.log
- %TEMP%\nsi3.tmp\ns4.tmp
- %TEMP%\nsi3.tmp\nsexec.dll
- %TEMP%\nsi3.tmp\system.dll
- %TEMP%\nsi3.tmp\userinfo.dll
- %TEMP%\nsi3.tmp\tvgetversion.dll
- %TEMP%\nsi3.tmp\nsarray.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_desktop.exe
- %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_nl.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_lt.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ko.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ja.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_it.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_id.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hu.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_he.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fi.dll
- %ProgramFiles%\teamviewer\tvextracttemp\uninstall.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_es.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_en.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_el.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_de.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_da.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_cs.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_bg.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ar.dll
- %TEMP%\nsi3.tmp\ns7.tmp
- %ProgramFiles%\teamviewer\teamviewer10_logfile.log
Deletes the following files
- %TEMP%\nsi3.tmp\ns4.tmp
- %TEMP%\nsi3.tmp\tvproc.dll
- %TEMP%\nsi3.tmp\tvgetversion.dll
- %TEMP%\nsi3.tmp\system.dll
- %TEMP%\nsi3.tmp\nsis7z.dll
- %TEMP%\nsi3.tmp\nsexec.dll
- %TEMP%\nsi3.tmp\nsarray.dll
- %TEMP%\nsi3.tmp\findprocdll.dll
- %ProgramFiles%\teamviewer\tvextracttemp\w2k\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\w2k\teamviewervpn.inf
- %TEMP%\teamviewer\tvinstalltemp\tvfile144.bak
- %TEMP%\teamviewer\tvinstalltemp\tvfile128.bak
- %TEMP%\teamviewer\tvinstalltemp\tvfile127.bak
- %TEMP%\nsi3.tmp\ns7.tmp
- %TEMP%\nsi3.tmp\ns6.tmp
- %TEMP%\nsi3.tmp\ns5.tmp
- %ProgramFiles%\teamviewer\tvextracttemp\tvfilesx86.7z
- %ProgramFiles%\teamviewer\tvextracttemp\tvfiles.7z
- %TEMP%\nsi3.tmp\tvupdateinfo.exe
- %TEMP%\nsi3.tmp\userinfo.dll
Moves the following files
- from %ProgramFiles%\teamviewer\tvextracttemp\copyrights_de.txt to %ProgramFiles%\teamviewer\copyrights_de.txt
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fi.dll to %ProgramFiles%\teamviewer\teamviewer_resource_fi.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_no.dll to %ProgramFiles%\teamviewer\teamviewer_resource_no.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ja.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ja.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ru.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ru.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ko.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ko.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_cs.dll to %ProgramFiles%\teamviewer\teamviewer_resource_cs.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ar.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ar.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhcn.dll to %ProgramFiles%\teamviewer\teamviewer_resource_zhcn.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pl.dll to %ProgramFiles%\teamviewer\teamviewer_resource_pl.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_tr.dll to %ProgramFiles%\teamviewer\teamviewer_resource_tr.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_bg.dll to %ProgramFiles%\teamviewer\teamviewer_resource_bg.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_el.dll to %ProgramFiles%\teamviewer\teamviewer_resource_el.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_he.dll to %ProgramFiles%\teamviewer\teamviewer_resource_he.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.sy_ to %ProgramFiles%\teamviewer\x86\teamviewervpn.sy_
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hr.dll to %ProgramFiles%\teamviewer\teamviewer_resource_hr.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_id.dll to %ProgramFiles%\teamviewer\teamviewer_resource_id.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_lt.dll to %ProgramFiles%\teamviewer\teamviewer_resource_lt.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ro.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ro.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sk.dll to %ProgramFiles%\teamviewer\teamviewer_resource_sk.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sr.dll to %ProgramFiles%\teamviewer\teamviewer_resource_sr.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_th.dll to %ProgramFiles%\teamviewer\teamviewer_resource_th.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_uk.dll to %ProgramFiles%\teamviewer\teamviewer_resource_uk.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_vi.dll to %ProgramFiles%\teamviewer\teamviewer_resource_vi.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhtw.dll to %ProgramFiles%\teamviewer\teamviewer_resource_zhtw.dll
- from %ProgramFiles%\teamviewer\lizenz_teamviewer_en_unicode.txt to %ProgramFiles%\teamviewer\license.txt
- from %ProgramFiles%\teamviewer\copyrights_en.txt to %ProgramFiles%\teamviewer\copyrights.txt
- from %ProgramFiles%\teamviewer\lizenz_teamviewer_de_unicode.txt to %TEMP%\teamviewer\tvinstalltemp\tvfile127.bak
- from %ProgramFiles%\teamviewer\copyrights_de.txt to %TEMP%\teamviewer\tvinstalltemp\tvfile128.bak
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pt.dll to %ProgramFiles%\teamviewer\teamviewer_resource_pt.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sv.dll to %ProgramFiles%\teamviewer\teamviewer_resource_sv.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_nl.dll to %ProgramFiles%\teamviewer\teamviewer_resource_nl.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_it.dll to %ProgramFiles%\teamviewer\teamviewer_resource_it.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fr.dll to %ProgramFiles%\teamviewer\teamviewer_resource_fr.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\lizenz_teamviewer_de_unicode.txt to %ProgramFiles%\teamviewer\lizenz_teamviewer_de_unicode.txt
- from %ProgramFiles%\teamviewer\tvextracttemp\lizenz_teamviewer_en_unicode.txt to %ProgramFiles%\teamviewer\lizenz_teamviewer_en_unicode.txt
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer.exe to %ProgramFiles%\teamviewer\teamviewer.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_desktop.exe to %ProgramFiles%\teamviewer\teamviewer_desktop.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_service.exe to %ProgramFiles%\teamviewer\teamviewer_service.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\uninstall.exe to %ProgramFiles%\teamviewer\uninstall.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_staticres.dll to %ProgramFiles%\teamviewer\teamviewer_staticres.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.dll to %ProgramFiles%\teamviewer\tv_w32.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.exe to %ProgramFiles%\teamviewer\tv_w32.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.dll to %ProgramFiles%\teamviewer\tv_x64.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.exe to %ProgramFiles%\teamviewer\tv_x64.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer10host.otf to %ProgramFiles%\teamviewer\teamviewer10host.otf
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.cat to %ProgramFiles%\teamviewer\x86\teamviewervpn.cat
- from %ProgramFiles%\teamviewer\x86\teamviewervpn.sy_ to %ProgramFiles%\teamviewer\x86\teamviewervpn.sys
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hu.dll to %ProgramFiles%\teamviewer\teamviewer_resource_hu.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.inf to %ProgramFiles%\teamviewer\x86\teamviewervpn.inf
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.inf to %ProgramFiles%\teamviewer\x86\tvmonitor.inf
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.sy_ to %ProgramFiles%\teamviewer\x86\tvmonitor.sy_
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer_printprocessor.dll to %ProgramFiles%\teamviewer\x86\teamviewer_printprocessor.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\tvprint.cat to %ProgramFiles%\teamviewer\x86\tvprint.cat
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\tvprint.inf to %ProgramFiles%\teamviewer\x86\tvprint.inf
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer.gpd to %ProgramFiles%\teamviewer\x86\teamviewer.gpd
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\tvpsprint.cat to %ProgramFiles%\teamviewer\x86\tvpsprint.cat
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\tvpsprint.inf to %ProgramFiles%\teamviewer\x86\tvpsprint.inf
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer.ppd to %ProgramFiles%\teamviewer\x86\teamviewer.ppd
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_en.dll to %ProgramFiles%\teamviewer\teamviewer_resource_en.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_de.dll to %ProgramFiles%\teamviewer\teamviewer_resource_de.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_es.dll to %ProgramFiles%\teamviewer\teamviewer_resource_es.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_da.dll to %ProgramFiles%\teamviewer\teamviewer_resource_da.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\copyrights_en.txt to %ProgramFiles%\teamviewer\copyrights_en.txt
- from %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.cat to %ProgramFiles%\teamviewer\x86\tvmonitor.cat
- from %ProgramFiles%\teamviewer\teamviewer10host.otf to %TEMP%\teamviewer\tvinstalltemp\tvfile144.bak
Substitutes the following files
- %ProgramFiles%\teamviewer\x86\teamviewervpn.sy_
Network activity
UDP
- DNS ASK pi###.#eamviewer.com
- DNS ASK do#####d.teamviewer.com
- DNS ASK wp#d
- DNS ASK ma#####.teamviewer.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\nsi3.tmp\ns4.tmp' schtasks /Create /TN TVInstallRestore /TR "<Full path to file> /RESTORE" /RU SYSTEM /SC ONLOGON /F
- '%TEMP%\nsi3.tmp\tvupdateinfo.exe'
- '%TEMP%\nsi3.tmp\ns5.tmp' %ProgramFiles%\TeamViewer\TeamViewer_Service.exe -install
- '%ProgramFiles%\teamviewer\teamviewer_service.exe' -install
- '%TEMP%\nsi3.tmp\ns6.tmp' %ProgramFiles%\TeamViewer\TeamViewer.exe --InstallAPI --StartedByInstaller
- '%ProgramFiles%\teamviewer\teamviewer.exe' --InstallAPI --StartedByInstaller
- '%TEMP%\nsi3.tmp\ns7.tmp' schtasks /Delete /TN TVInstallRestore /F
- '%ProgramFiles%\teamviewer\teamviewer_service.exe'
- '%ProgramFiles%\teamviewer\teamviewer.exe'
- '%ProgramFiles%\teamviewer\tv_w32.exe' --action hooks --log %ProgramFiles%\TeamViewer\TeamViewer10_Logfile.log
- '%TEMP%\nsi3.tmp\ns4.tmp' schtasks /Create /TN TVInstallRestore /TR "<Full path to file> /RESTORE" /RU SYSTEM /SC ONLOGON /F' (with hidden window)
- '%TEMP%\nsi3.tmp\ns5.tmp' %ProgramFiles%\TeamViewer\TeamViewer_Service.exe -install' (with hidden window)
- '%TEMP%\nsi3.tmp\ns6.tmp' %ProgramFiles%\TeamViewer\TeamViewer.exe --InstallAPI --StartedByInstaller' (with hidden window)
- '%TEMP%\nsi3.tmp\ns7.tmp' schtasks /Delete /TN TVInstallRestore /F' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /TN TVInstallRestore /TR "<Full path to file> /RESTORE" /RU SYSTEM /SC ONLOGON /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN TVInstallRestore /F
