Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\setup.js
- <SYSTEM32>\tasks\teamviewer
Modifies file system
Creates the following files
- %TEMP%\aut27b3.tmp
- %TEMP%\setup.exe
- %TEMP%\aut27c3.tmp
- %TEMP%\setup.js
- %TEMP%\dup2patcher.dll
- %LOCALAPPDATA%\setup.js
Deletes following files that it created itself
- %TEMP%\aut27b3.tmp
- %TEMP%\aut27c3.tmp
Network activity
UDP
- DNS ASK se######dexer.myq-see.com
Miscellaneous
Creates and executes the following
- '%TEMP%\setup.exe'
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\setup.js"
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 30 /tn teamviewer /tr "%LOCALAPPDATA%\setup.js
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 30 /tn teamviewer /tr "%LOCALAPPDATA%\setup.js' (with hidden window)
