Threat Actor Group Reappears With Teamviewer Malware Package

What’s TVSPY?

TVSPY is a malware that takes advantage of a vulnerability in Teamviewer software version 6, a legitimate tool used for remote PC administration. The malware is also known as TVRAT, SpY-Agent or teamspy. While the current version of Teamviewer fixed this vulnerability, TVSPY relies on bundling Teamviewer v6 in a package with a copy of the malware. It works independently of any existing Teamviewer installation.

TVSPY: APT or Crimeware?

Eset and Group-IB discussed this malware as crimeware back in 2011 at CARO, while Kaspersky mentions it in one of their APT reports from 2013, with a detailed description of its routine. There seems to be an increase in the prevalence of these malware variants recently. The number of unique variants we have already seen in 2015 is 4.4x the number seen in 2012, and 2.2x that seen in all of 2014. There are some instances of Dridex installing this malware as well. This malware has been relatively quiet for more than two years so the nearly three-fold increase in activity is concerning.

More recently, a targeted email campaign included a malicious Excel file with a macro would download this malware. The email was impersonating the All-Russian Research and Design Institute of Nuclear and Energy Engineering. The analysis of the Command and Control server for this latest variant appears to be owned by professional criminals.

Who sells TVSPY?

Scalpel started to sell this malware on criminal forums last June 2014 for $400. He took over the sale for Mr.Burns. The original malware was created by Mr.Burns, he created something similar called RMS. Mr.Burns found a way to take advantage of Teamviewer v6 using a DLL to hijack the session. Teamviewer v6 was released in 2010. We were able to obtain a public version of RMS 5.6 that looks very much like the TVSPY builder. Mr.Burns recently deleted his youtube channel where he had 2 videos showing how RMS and TVSPY work.

Scalpel information

Handles :

scalpel
brutalisk
overd0s3r

Emails :

bio@insorg-mail.info
scalpel@insorg-mail.info
missis.ljasan@yandex.ru

Jabber :

scalpel@jabb3r.net
sl@adium.in
sl@exploit.im

Mr.Burns information

Name used in Youtube/Google+ :

Иван Иванов – Ivan Ivanov

Handles :

Mr.Burns

Emails :

sonofabitch@ua.fm
mrburns@nm.ru

Jabber :

mrburns@jabber.se

Skype :

mr.monty.burns

ICQ :

610047
A video demo of Spy-Agent was posted on YouTube, but has since been deleted.

pic4a information

Jabber :

pic4a@exploit.im
pic4a@fuckav.in

Conclusion

This particular threat is very dangerous as the attacker will have total control over the affected machine. We see that it can be used during a regular infection campaign or by some APT actors for specific attacks against particular targets. RMS/TVSPY continues to be developed, with a new version being posted by the developer/reseller on a regular basis. In fact, the legitimate RMS version developed by TektonIT and the version posted in criminal forums appear to be identical. TVSPY seems to be merely a modification of RMS to utilize TeamViewer infrastructure and a command and control interface manageable through the web.

Damballa detects TVSPY as BlueSpiderCrashers.

Loucif Kharouni
Senior Threat Researcher
Willis McDonald
Senior Threat Researcher

Indicators of compromise :

Under C:\kernel (folder kernel has hidden attribute) :

Under C:\Users\[UserName]\AppData\Roaming (all files use hidden attribute) :

Here is a text version of the GET request made by the malware :

/getinfo.php?id=[0-9]{9}&stat=1&tout=60&osbt=1&osv=5.1&osbd=2600&ossp=3.0&ulv=4&elv=1&rad=1&agp=1&devicea=1&devicev=0&uname=[username]&cname=[computer_name]&vpn=1&tvrv=0.2.2.1

The last variable is particularly interesting as this is the first time we have seen it. Other samples we analyzed have not displayed this variable.

Command and control servers

5.45.70.137/stats/getinfo.php
78.47.135.84/contacts/getinfo.php
91.121.44.159/tvddj39/gerinfo.php
91.215.155.46/tv/getinfo.php
91.215.155.48/tv/getinfo.php
92.53.96.101/getinfo.php
109.234.35.77/btrtrxirmi/getinfo.php
162.211.230.170/tv/getinfo.php
178.63.249.40/awstat/getinfo.php
194.63.142.171/tv/getinfo.php
206.su/admin42/getinfo.php
ac.myjino.ru/getinfo.php
aflnatour.ru/admin/getinfo.php
aflnatour.ruadmin/getinfo.php
bestkassa.com/tb/getinfo.php
blackvfl.com/tv0/getinfo.php
bo1324522.com/tv/getinfo.php
cdn-rskp.com/cdn/getinfo.php
cofewariiroirm.ru/1/getinfo.php
darlingday.ru/getinfo.php
doomns.mooo.com/getinfo.php
f1rst.name/tv/getinfo.php
filidaro.com/rvbtdsf/getinfo.php
jmai1.com/tv/getinfo.php
mmm-svoboda2012.ru/getinfo.php
nynewsguardianinternet.com/NotebookFront/getinfo.php
statisticsystic.com/telekinect/getinfo.php
tim-t.ru/getinfo.php
tvincoming.com/adm/getinfo.php
util4u.com/ctrl/getinfo.php
wowcofes.ru/getinfo.php

Hashes

a55149b4164659d5c0e1cd2daef9a702
21670682a47021cc4be53ea832df7dbd
efa5c157946125734184a1cb62c6a0e1
f84928ea5b4752b9cc2a7ae2155d6fd5
688be0a5684dbe633ea86d3640e33d47
070859ed01990f003b78d9820e77d72e
9146902c590c98b8b2c4bb7d323623cd
c3de5426a4fec6e97acd1f693081615e
8852fb707e1a5c5d505b6a026e8ddab5
718633f40da55c76f0c6c7c81824799f
b36a11b189242e071e8c8e564aab56e2
2afa10d90a4899f9215f77b1db9230e3
99bdcab182678da0dcf52aa4a0795b05
d88e492a0c91441bc4385e0dfe69caf2
09e20b095e0aa1d8aa2f9c16ff76b1e9
407cd02af6ea3a7b2d4246ba8f89b076
71d1cf7dc21dfa5fa0a615cfa06dc297
255e3db5aa603384d2ca4594b18dc609
fd90061743e0f33ae5135cb2fbf7057e
0c368c121f13928d9699fbc93eead367
4414e69f4b895551f5a90abb59ff2330
30ebfdc2a2e90ccd0649ccdf853f1e9d
bc8eb8677390f90de921592c86f17040
3a8455584bda5951b8c0a05deed87b4f
eb88459f2d532fa3fcc081e2e6a1d549
008cc983f88b87f8b804988ac4c8d532
7a5972a7038f224ff97e02c13082e418
33d079af33b3689a9d6a9517b39c8d7b
5190aa75867dde7ca172c2c30d19dcf3
4a9fdd47041252608801d16b4ac11e12
b4dc51648fa10c349453d80c8cfabed2
13467f0886de6d0c6716ac0a4eeb2f59
c5c05c0f4b9e3b6ac2ad51dc15ef8f43
f7a4602db94cd67e9c03d918eaef91a2
8b0d8f1d06aea9bc5c7477c9c8284713
4c177ad2a07a304318d09fc4ef389a09
1a141a76d12f7a310ade141133c0a37c
a5aff9aa5b2e45a0f9fea080f8f15971
1a9b23d9e18c5d19e86fc5a89012a0ef
8230f1f93245528c1faa82d945c25332
18faa7856fda324ed06261368ab72829
b7ab83f84103130e46e95de0df8d85a4
740d9cd8ea165302aa3cd7e6f198ea4c
9079fc3edc31956ab63bbb23673e6c7c
1fe21a120f524bb914b210284e1caf05
36f2049cc1a5db224fcd6541d630677f
58f1852af6a270d385f270d60d00a0a5

[su_box title=”About Damballa” style=”noise” box_color=”#336588″]As a leader in automated breach defence, Damballa delivers advanced threat protection and containment for active threats that bypass all security prevention layers. Born for breach defence, Damballa rapidly discovers infections with certainty, pinpointing the compromised devices that represent the highest risk to a business, and enabling prioritized response and refocusing of security experts to the areas of greatest risk to an enterprise. Our patented solutions leverage Big Data from one-third of the worlds Internet traffic, combined with machine learning, to automatically discover and terminate criminal activity, stop data theft, minimize business disruption, and reduce the time to response and remediation. Damballa protects any device or OS including PCs, Macs, Unix, iOS, Android, and embedded systems. Damballa protects more than 400 million endpoints globally at enterprises in every major market and for the world’s largest ISP and telecommunications providers.[/su_box]