BackDoor.TeamViewerENT.1

SHA1:

• 001c13d05841d2a82229a35fe58235743f1564fe (dropper)
• 0660cadef21d2061e776e4bcaa6aa4fb48a778be (avicap32.dll)

A backdoor Trojan for Microsoft Windows that is distributed under the name Spy-Agent. It uses the TeamViewer remote control utility components to spy on users. The Trojan has three encrypted blocks of executable code, The blocks are decrypted one by one. The first block is encrypted with BASE64 and XOR, and the others—with BASE64 and RC4.

The Trojan’s payload is placed into the avicap32.dll library. Once launched, the Trojan disables error messaging for the TeamViewer process. When the configuration is read, it is encrypted with a local key and saved to the previous location. The Trojan intercepts function calls in TeamViewer address area and appends all files in its folder with the attributes “system”, “hidden”, and “read only”.

The Trojan has a list of TeamViewer file checksums and regularly checks them with the help of the API MapFileAndCheckSumA function. If certain files or components are missing for normal operation of TeamViewer, the Trojan downloads them from its command and control (C&C) server. To ensure its autorun, the Trojan modifies particular branches of the Windows system registry, selecting branches from HKCU or HKLM. It depends on whether the Trojan has administrative privileges or not.

The Trojan also removes the tvicap32.dll file. Then it launches a separate thread that kills TeamViewer processes if it detects that TASKMGR.EXE or PROCEXP.EXE are running.

The backdoor uses additional plug-ins, which have .pg extension and are stored in the same folder as the Trojan. To launch them, the backdoor bypasses its folder when searching for .pg files. If it detects files with this extension, it launches several threads (depending on the number of detected files), which decrypt these files using RC4 and load them to the memory.

To send a message about the status, the Trojan determines the cursor location and, after some time specified in the configuration, it sends the following request to the command and control server:

Where the address is taken from the configuration, <TV_ID> - ID TeamViewer, <botId> is a unique ID of the infected computer, <cur_time> is a current time in the “YYYY-MM-DD hh:mm:ss” format.

Further requests are sent only if the cursor location is changed or if one of the following keys is pressed: VK_RETURN, VK_SPACE, VK_SHIFT. The Trojan then executes the following request:

Where the address is taken from the configuration, <TV_ID> - ID TeamViewer, <botId> is a unique ID of the infected computer, <cur_time> is a current time in the “YYYY-MM-DD hh:mm:ss” format, —time of the Trojan’s operation in idle mode in seconds (since the last request was sent to the server).

To get instructions from the server, the Trojan waits for a particular number of seconds and then sends the following request to the server:

Where the address is taken from the configuration, <TV_ID> - ID TeamViewer, <botId> is a unique ID of the infected computer, <uptime> is a time of the Trojan’s operation in idle mode in seconds (since the last request was sent to the server).

The Trojan checks the server’s reply for the presence of the “!” character that means the beginning of the command. Then it breaks the line by line arrays that have ‘;’and ‘\r’ separators. The first line in an array is a command.

Once the commands are executed, the following request is sent to the server:

The Trojan can execute the following commands:

News about the Trojan