# A deeper look into malware abusing TeamViewer

**[blog.avast.com/a-deeper-look-into-malware-abusing-teamviewer](https://blog.avast.com/a-deeper-look-into-malware-abusing-teamviewer)**

[Jaromír Hořejší 13 Apr 2017](https://blog.avast.com/author/jarom%C3%ADr-ho%C5%99ej%C5%A1%C3%AD)

Analyzing TeamSpy, malware that gives hackers complete remote control of PCs.

TeamViewer, a remote control program, can be very handy when you need remote IT
support. The cybercriminals behind TeamSpy, unfortunately, also find the tool to be quite
useful and use it to carry out malicious activity.

TeamSpy infects computers by tricking people into downloading a malicious attachment and
enabling macros. After that, the [malware secretly installs TeamViewer, giving the](https://www.avast.com/c-malware)
cybercriminals full control of the infected computer. TeamSpy first appeared back in 2013,
[which is when CrySyS Lab and](https://www.crysys.hu/teamspy/teamspy.pdf) [Kaspersky Lab published white papers about its operation.](https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/theteamspystory_final_t2.pdf)
[Heimdal Security recently reported that the malware has resurfaced with a targeted spam](https://heimdalsecurity.com/blog/security-alert-teamspy-turn-teamviewer-into-spying-tool/)
campaign. We too have seen an uptick and have therefor decided to take a closer look.


-----

## Hiding commands

Most malware communicates with a command and control (C&C) server after infecting a
device. As the name suggests, a C&C server is the control center that sends out commands
for malware to carry out. C&C servers are also where malware sends back the data it
collects. For this communication, malware authors usually implement a custom protocol,
which can be easily spotted and distinguished from other traffic and thus blocked by antivirus
solutions. To make it more difficult for antivirus solutions to detect, some malware authors
use popular remote control programs, like TeamViewer, instead to take advantage of their
[VPN network to better mask the communication between their malware and C&C servers.](https://www.avast.com/c-what-is-a-vpn)

## How TeamSpy infects

TeamSpy is spread via spam emails that are designed to trick people into opening an
attachment. The attachment is an Excel file with macros. When the attachment is opened,
the following screen appears:


-----

When the macros are enabled by the targeted person, the infection process begins, running
completely in the background, so the victim doesn't notice anything. If we look inside the
malicious macro, we can see slightly obfuscated strings, usually split into one or more
substrings, which are later concatenated. The most important information is circled in red
below and are a link, from which something is downloaded, and a password, which will be
used later.

The link, disk.karelia.pro, is a legitimate Russian service for uploading and sharing files.
Although the attachment of the downloaded is a PNG, it is actually an EXE file, more
[specifically it is an Inno Setup installer protected by the password.](http://www.jrsoftware.org/isinfo.php)

With the help of the [innounp utility, we were able to easily list or extract the files from the Inno](http://innounp.sourceforge.net/)
Setup installer used by the malware. As shown in the listing below, most of the files are
regular, digitally signed TeamViewer binaries, with the exception of two files - msimg32.dll
and tvr.cfg. Tvr.cfg is TeamSpy’s configuration file and will be described later, msimg32.dll is
the malware itself. Msimg32.dll is a DLL library which is part of Windows OS. In this case,
[however, TeamSpy abuses the DLL search order, so that the fake msimg32.dll from the](http://resources.infosecinstitute.com/dll-hijacking-attacks-revisited/)
current directory is loaded into the process instead of the original msimg32.dll from
_Windows/System32 directory. The malware itself is in the fake msimg32.dll library._


-----

## TeamSpy’s invisibility cloak

Normally when you install the TeamViewer, you see a GUI window with an ID and password,
which the other party needs to know if they want to remotely connect to your computer.


-----

If TeamSpy successfully infects a PC, nothing is shown - remember everything runs in the
background, so that the victim doesn’t notice TeamViewer is installed. This is achieved by
hooking many API functions and altering their behavior. TeamSpy hooks the following APIs
(nearly 50 different APIs):

kernel32.dll

CreateMutexW, CreateDirectoryW, CreateFileW, CreateProcessW, GetVolumeInformationW,
GetDriveTypeW, GetCommandLineW, GetCommandLineA, GetStartupInfoA, MoveFileExW,
CreateMutexA

user32.dll

SetWindowTextW, TrackPopupMenuEx, DrawTextExW, InvalidateRect, InvalidateRgn,
RedrawWindow, SetWindowRgn, UpdateWindow, SetFocus, SetActiveWindow,
SetForegroundWindow, MoveWindow, DialogBoxParamW, LoadIconW, SetWindowLongW,
FindWindowW, SystemParametersInfoW, RegisterClassExW, CreateWindowExW,


-----

CreateDialogParamW, SetWindowPos, ShowWindow, GetLayeredWindowAttributes,
SetLayeredWindowAttributes, IsWindowVisible, GetWindowRect, MessageBoxA,
MessageBoxW

advapi32.dll

RegCreateKeyW, RegCreateKeyExW, RegOpenKeyExW, CreateProcessAsUserW,
CreateProcessWithLogonW, CreateProcessWithTokenW, Shell_NotifyIconW, ShellExecuteW

iphlpapi.dll

GetAdaptersInfo

Some hooks block the application’s access to some specific resources, e.g. if _[RegCreateKey](https://msdn.microsoft.com/en-us/library/windows/desktop/ms724844(v=vs.85).aspx)_
or _[RegOpenKey attempt to access the Software\TeamViewer registry key, the error code:](https://msdn.microsoft.com/en-us/library/windows/desktop/ms724895(v=vs.85).aspx)_
_ERROR_BADKEY is returned._

[Hooking the GetCommandLine makes TeamViewer think that it was started with a predefined](https://msdn.microsoft.com/en-us/library/windows/desktop/ms683156(v=vs.85).aspx)
password (instead of a randomly generated password, TeamViewer users can normally set
this password to an arbitrary value by adding a command line parameter)


-----

[Hooking SetWindowLayeredAttributes sets the TeamViewer window opacity to 0 (instruction](https://msdn.microsoft.com/en-us/library/windows/desktop/ms633540(v=vs.85).aspx)
_PUSH 0), which according to the MSDN_ [documentation means the following: “When bAlpha](https://msdn.microsoft.com/en-us/default.aspx)
is 0, the window is completely transparent. When bAlpha is 255, the window is opaque.”

[Hooking CreateDialogParam blocks some dialogs unwanted by the malware from even being](https://msdn.microsoft.com/en-us/library/windows/desktop/ms645445(v=vs.85).aspx)
created. These dialogs can be looked up in the file TeamViewer_Resource_en.dll, they are
referenced with numbers like 10075, see the figure below.

In case of [ShowWindow, it defines it’s own nCmdShow parameters 4d2h and 10e1h. If other](https://msdn.microsoft.com/en-us/library/windows/desktop/ms633548(v=vs.85).aspx)
values than these are passed, nothing happens.


-----

[Probably the most interesting is the hooking of the CreateWindowEx API. Via a series of](https://msdn.microsoft.com/en-us/library/windows/desktop/ms632680(v=vs.85).aspx)
class name checks, it identifies a window and other window controls that belong to the
TeamViewer chat window. With help of a tool like [WinSpy++, we can see all the windows](http://www.catch22.net/software/winspy-17)
belonging to the particular process (even if they are hidden). As you can see from the figure
below, there is a ControlWin window, which has several TVWidgets. One widget belongs to
the chat - it has two ATL:???????? text edits, one for the chat message history and one for
the new chat message, one combo box with a drop down list of chat participants and the
button Send. “message 01” is the received message in the chat, “message 02” is message
which will be sent after clicking the “Send” button. The chat window cannot be normally seen,
as the malware runs in the background, but it is possible to patch the malware, so that hiding
windows does not happen.

The code snippet below shows how the malware obtains handles to these window controls.
_[GetWindowLong and](https://msdn.microsoft.com/en-us/library/windows/desktop/ms633584(v=vs.85).aspx)_ [CallWindowProc and](https://msdn.microsoft.com/en-us/library/windows/desktop/ms633571(v=vs.85).aspx) _[SetWindowLong with nIndex = GWL_PROC](https://msdn.microsoft.com/en-us/library/windows/desktop/ms633591(v=vs.85).aspx)_
replaces the old address for the window procedure of the chat history text edit with a custom


-----

window procedure.

The custom window procedure listens for incoming messages, and based on the window
message id, it either sends a new message or it waits for a reply from the C&C server
[(EM_SETCHARFORMAT message arrived).](https://msdn.microsoft.com/en-us/library/windows/desktop/bb774230(v=vs.85).aspx)

The figure below shows how a new message is sent. Malware first sets focus to the new
message text edit with _[WM_SETFOCUS, then it sets the new message edit text by](https://msdn.microsoft.com/en-us/library/windows/desktop/ms646283(v=vs.85).aspx)_
_[WM_SETTEXT and at last it clicks on the “Send” button by sending BM_CLICK.](https://msdn.microsoft.com/en-us/library/windows/desktop/ms632644(v=vs.85).aspx)_


-----

Similar modifications are applied to most of the 50 APIs listed above. Some patches are very
simple, having no more than a few instructions, while some patches are very complex, like
_[CreateWindowEx. We will not list all of them here, however, the final effect is clear -](https://msdn.microsoft.com/en-us/library/windows/desktop/ms632680(v=vs.85).aspx)_
TeamViewer’s windows are not displayed to the victim. They silently exist in the system and
that’s all.

## Configuration file

TeamSpy’s configuration is stored in tvr.cfg file. It uses a simple custom [encryption algorithm,](https://www.avast.com/c-encryption)
which can be seen below. It reads the input file and uses the password “TeamViewer”. The
algorithm runs two counters, cnt1 (0..number of bytes in tvr.cfg ) and cnt2 (0..length of the
password). It takes a byte from the password, adds the result of the multiplication cnt1*cnt2.
This is done for each character of the password. These results are all XORed, one character
is produced, and at the end of the loop, it is XORed with the respective byte from the
configuration file. These steps are repeated for all bytes in configuration file.


-----

The decrypted configuration file can be seen below. The names of the parameters are mostly
self explanatory. The most important for us are the password (infected machine has
password “superpass” ) and server1, where the infected machine ID is exfiltrated.

## Phoning home

The communication between the infected machine and the C&C server is established soon
after the infection process starts. The following request is regularly sent. The names of most
parameters can be clearly deduced.

_id = TeamViewer ID, cybercriminals need this id, which together with the password are_
enough to remotely connect to the infected computer

_tout = timeout_

_idl = idle time_

_osbt = 32bit/64bit_

_osv = OS version_

_osbd = OS build version_

_ossp = service pack_


-----

_tvrv = TeamViewer version_

_uname = user name_

_cname = computer name_

_vpn = has TeamViewer vpn_

_avr = antivirus solution_

When we open the C&C server in a web browser, we see the following login page:

## Chat control

The infected computer is controlled via TeamViewer. Cybercriminals can connect to the
remote computer (they know the ID and password for TeamViewer) or they can send
commands via the TeamViewer chat, to basically do whatever they please on the infected
machine. The communication via the TeamViewer chat allows for the basic backdoor
functionalities to be performed: applist, wcmd, ver, os, vpn, locale, time, webcam, genid.
Inside the TeamSpy code, these commands are compared to their crc32 checksums, so
collisions can very easily happen. Because crc32(wcmd) = 07B182EB = crc32(aacvqdz),
both of these commands are interchangeable.


-----

Using TeamViewer’s legitimate VPN encrypts the traffic and makes it indistinguishable from
legitimate TeamViewer traffic. Once the machine is infected, the criminals have full access to
the computer. They can steal and exfiltrate sensitive data, download and execute arbitrary
programs, and more.

Abusing the legitimate application with sideloading is a clever technique, because not every
user checks legitimacy of all the DLL libraries in the same directory. Checking the signature
of the main executable does not reveal anything suspicious and may let the victim think that


-----

everything is alright. See the digital signature of the main update_w32.exe file below. This file
is not malicious.

It is important to remember that there are more malware classes that abuse TeamViewer,
not just TeamSpy. This blogpost just describes one of them. The principle is, however, similar
in other malware classes.

5.0 SHAs

XLS with macros

[FE7CA42EE57CEDAD4E539A01A1C38E22F3A4EDC197D95237E056AF02F252C739](https://virustotal.com/en/file/fe7ca42ee57cedad4e539a01a1c38e22f3a4edc197d95237e056af02f252c739/analysis/)

Password protected Inno Installer

[AD377654518C19BE85FA6BF09570D8D1C8ABA52FFCD83061127851A2DAEF4858](https://virustotal.com/en/file/AD377654518C19BE85FA6BF09570D8D1C8ABA52FFCD83061127851A2DAEF4858/analysis/)

Fake msimg32.dll

[921FB1D6E783A6CA70BD1399EA5A18C78027D3016BEA6881F132A253F3C97ED6](https://virustotal.com/en/file/921FB1D6E783A6CA70BD1399EA5A18C78027D3016BEA6881F132A253F3C97ED6/analysis/)

6.0 and yes, we detect it


-----