Report - CrySyS Lab

5. Analysis of individual modules
5.1 Avicap32.dll
The investigation described in this document was started by the discovery of unusual network traffic
patterns. Later, it was found that the suspicious network traffic is due to a malware based on the
TeamViewer application. The installation of the malware is based on a NullSoft installer. We are
aware of two versions of this installer using the filenames DSC.exe and TeamViewer.ico. During
installation, the following files are saved into the folder “\Documents and Settings\user\Application
Data”:
avicap32.dll
TeamViewer.exe (d0847c10f8b2253b194cda859d3a52a3)
TeamViewer_Resource_ru.dll (165e720c32ae372864b9b654e44e2650)
tv.cfg
The TeamViewer parts are genuine, digitally signed TeamViewer binaries, except for Avicap32.dll.
The DLL Avicap32.dll modifies the behavior of TeamViewer by removing its icon from the system
tray. The module uses the encrypted tv.cfg configuration file, which contains parameters for the C&C
communication. The encryption is based on the Volume ID of the hard drive.
result = GetVolumeInformationA(
RootPathName,
0,
0,
&VolumeSerialNumber,
&MaximumComponentLength,
&FileSystemFlags,
0,
0);
if ( result )
{
v1 = VolumeSerialNumber;
v5 = VolumeSerialNumber ^ _byteswap_ulong(VolumeSerialNumber);
v2 = 0;
v3 = 4;
do
{
v4 = *((_BYTE *)&v5 + v2++);
v1 = v4 + ((v1 >> 27) | 32 * v1);
--v3;
}
while ( v3 );
result = v1;
}
Figure 35 – tv.cfg encryption key derived from Volume ID
If the malware finds procexp.exe (Sysinternals Process Explorer) running, then it quits. Simple
renaming of the tool can help during investigations. More detailed analysis is ongoing on this sample.
28