TeamSpy

The command-and-control domains were paid for using virtual currency, and thousands of computers infected by the TVRAT malware were 'calling back' to a command-and-control domain hosted in the United States.

Aktulaev is accused of sending emails with Excel attachments that, when opened, prompted recipients to run a macro.

[Aktulaev] conspired to exploit the online message platform of a well-known freelance employment technology company ... to spread malware.

The communication via the TeamViewer chat allows for the basic backdoor functionalities to be performed: applist , wcmd , ver , os , vpn , locale , time , webcam , genid .

This macro then downloaded one of two malware types: a variant of TVRAT (also known as TeamSpy) or DarkVNC.

TVRAT allows its users to exploit a vulnerability in remote access tool TeamViewer and take over a victim’s device. DarkVNC... exploited a bug in... VNC Viewer.

Excel attachments that, when opened, prompted recipients to run a macro.

Вместе с подписанными бинарниками TeamViewer устанавливалась вредоносная библиотека msimg32.dll. Используя технику DLL hijacking, она загружалась вместо штатной DLL Windows.

If we look inside the malicious macro, we can see slightly obfuscated strings, usually split into one or more substrings, which are later concatenated.

Although the attachment of the downloaded is a PNG, it is actually an EXE file... most of the files are regular, digitally signed TeamViewer binaries, with the exception of two files - msimg32.dll and tvr.cfg.

Hooking SetWindowLayeredAttributes sets the TeamViewer window opacity to 0... The final effect is clear - TeamViewer’s windows are not displayed to the victim. They silently exist in the system and that’s all.

Вместе с подписанными бинарниками TeamViewer устанавливалась вредоносная библиотека msimg32.dll. Используя технику DLL hijacking, она загружалась вместо штатной DLL Windows.

The tools ... check for the existence of specific files, windows registry entries ... For example, SIG2 includes System\CurrentControlSet\Control\CrashImage and SIG23 includes software\microsoft\NetWin.

They check for the existence of specific files, windows registry entries, and other signs ... For example, this script looks for the existence of an actual file “winver32.exe” in the very specific $docsandsettings\\$subkey\\Application Data\\winver32.exe path.

Aktulaev used the access to steal data from victims... Aktulaev kept a document with stolen e-commerce login credentials and personal information on hundreds of victims.

Thousands of computers infected with TVRAT were calling back to a command-and-control domain hosted in the U.S. The infected machine then reports its TeamViewer ID to a C2 server.

Thousands of computers infected by the TVRAT malware were 'calling back' to a command-and-control domain hosted in the United States.

This macro then downloaded one of two malware types: a variant of TVRAT (also known as TeamSpy) or DarkVNC.

Both malware types provided operators with remote control of infected computers.

Both malware types provided operators with remote control of infected computers and exfiltrated stolen data to command-and-control servers.

server1, where the infected machine ID is exfiltrated... Using TeamViewer’s legitimate VPN encrypts the traffic and makes it indistinguishable from legitimate TeamViewer traffic.

Aktulaev used the access to steal data from victims and commit fraud.