{ "Name": "TeamViewer", "Category": "RMM", "Description": "TeamViewer is a remote monitoring and management (RMM) tool.\n", "Author": "Nasreddine Bencherchali, Michael Haag", "Created": "2024-08-02", "LastModified": "2025-12-14", "Details": { "Website": "https://www.teamviewer.com/en", "PEMetadata": [ { "Filename": "TeamViewer.exe", "OriginalFileName": "", "Description": "", "Product": "TeamViewer" } ], "Privileges": "user", "Free": true, "Verification": false, "SupportedOS": [ "Android", "ChromeOS", "IOS", "Linux", "Mac", "Windows" ], "Capabilities": [], "Vulnerabilities": [ "https://www.cvedetails.com/vulnerability-list/vendor_id-11100/product_id-19942/Teamviewer-Teamviewer.html" ], "InstallationPaths": [ "C:\\Program Files\\TeamViewer\\", "teamviewer_desktop.exe", "teamviewer_service.exe", "teamviewerhost" ] }, "Artifacts": { "Disk": [ { "File": "C:\\Users\\\\AppData\\Local\\Temp\\TeamViewer\\TV15Install.log", "Description": "N/A", "OS": "Windows" }, { "File": "TeamViewer\\d\\d_Logfile\\.log", "Description": "N/A", "OS": "Windows", "Type": "Regex" }, { "File": "C:\\Program Files\\TeamViewer\\Connections_incoming.txt", "Description": "N/A", "OS": "Windows" }, { "File": "C:\\Program Files\\TeamViewer\\TVNetwork.log", "Description": "N/A", "OS": "Windows" }, { "File": "%LOCALAPPDATA%\\Temp\\TeamViewer\\TV15Install.log", "Description": "N/A", "OS": "Windows" }, { "File": "%APPDATA%\\\\TeamViewer\\\\TeamViewer\\d\\d_Logfile\\.log", "Description": "N/A", "OS": "Windows", "Type": "Regex" }, { "File": "teamviewerqs.exe", "Description": "N/A", "OS": "Windows" }, { "File": "tv_w32.exe", "Description": "N/A", "OS": "Windows" }, { "File": "tv_w64.exe", "Description": "N/A", "OS": "Windows" }, { "File": "tv_x64.exe", "Description": "N/A", "OS": "Windows" }, { "File": "teamviewer.exe", "Description": "N/A", "OS": "Windows" }, { "File": "teamviewer_service.exe", "Description": "N/A", "OS": "Windows" }, { "File": "%LOCALAPPDATA%\\TeamViewer\\Database\\tvchatfilecache.db", "Description": "SQlite 3 database storing cache about TeamViewer chat", "OS": "Windows" }, { "File": "%LOCALAPPDATA%\\TeamViewer\\RemotePrinting\\tvprint.db", "Description": "SQlite 3 database storing TeamViewer print jobs", "OS": "Windows" }, { "File": "%PROGRAMDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\TeamViewer.lnk", "Description": "N/A", "OS": "Windows" }, { "File": "C:\\Program Files*\\TeamViewer\\connections*.txt", "Description": "N/A", "OS": "Windows" }, { "File": "C:\\Users\\*\\AppData\\Roaming\\TeamViewer\\MRU\\RemoteSupport\\*tvc", "Description": "N/A", "OS": "Windows" } ], "EventLog": [ { "EventID": 7045, "ProviderName": "Service Control Manager", "LogFile": "System.evtx", "ServiceName": "TeamViewer", "ImagePath": "\"C:\\\\Program Files\\\\TeamViewer\\\\TeamViewer_Service.exe\"", "Description": "Service installation event as result of TeamViewer installation." } ], "Registry": [ { "Path": "HKLM\\SOFTWARE\\TeamViewer\\*", "Description": "N/A" }, { "Path": "HKU\\\\SOFTWARE\\TeamViewer\\*", "Description": "N/A" }, { "Path": "HKLM\\SYSTEM\\CurrentControlSet\\Services\\TeamViewer\\*", "Description": "N/A" }, { "Path": "HKLM\\SOFTWARE\\TeamViewer\\ConnectionHistory", "Description": "N/A" }, { "Path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\TeamViewer\\*", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\MainWindowHandle", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\DesktopWallpaperSingleImage", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\DesktopWallpaperSingleImagePath", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\DesktopWallpaperSingleImagePosition", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\MinimizeToTray", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\MultiMedia\\AudioUserSelectedCapturingEndpoint", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\MultiMedia\\AudioSendingVolumeV2", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\MultiMedia\\AudioUserSelectedRenderingEndpoint", "Description": "N/A" }, { "Path": "HKLM\\SOFTWARE\\TeamViewer\\ConnectionHistory", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\ClientWindow_Mode", "Description": "N/A" }, { "Path": "HKU\\SID\\SOFTWARE\\TeamViewer\\ClientWindowPositions", "Description": "N/A" } ], "Network": [ { "Description": "Known remote domains", "Domains": [ "*.teamviewer.com" ], "Ports": [] }, { "Description": "N/A", "Domains": [ "router15.teamviewer.com" ], "Ports": [ 443 ] }, { "Description": "N/A", "Domains": [ "client.teamviewer.com" ], "Ports": [ 443 ] }, { "Description": "N/A", "Domains": [ "taf.teamviewer.com" ], "Ports": [ 443 ] } ], "Other": [ { "Type": "Mutex", "Value": "TeamViewer_LogMutex" }, { "Type": "Mutex", "Value": "TeamViewerHooks_DynamicMemMutex" }, { "Type": "Mutex", "Value": "TeamViewer3_Win32_Instance_Mutex" } ] }, "Detections": [ { "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/teamviewer_registry_sigma.yml", "Description": "Detects potential registry activity of TeamViewer RMM tool" }, { "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/teamviewer_network_sigma.yml", "Description": "Detects potential network activity of TeamViewer RMM tool" }, { "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/teamviewer_files_sigma.yml", "Description": "Detects potential files activity of TeamViewer RMM tool" }, { "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/teamviewer_processes_sigma.yml", "Description": "Detects potential processes activity of TeamViewer RMM tool" } ], "References": [ "https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer", "https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#", "https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/", "https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html", "https://github.com/Purp1eW0lf/Blue-Team-Notes" ], "Acknowledgement": [ { "Person": "Théo Letailleur", "Handle": "in/theosyn" } ], "CodeSigning": { "search_names": [ "teamviewer_desktop.exe", "teamviewer_service.exe" ], "company_names": [], "signer_names": [ "TeamViewer Germany GmbH", "TeamViewer GmbH" ], "certificates": [ { "signer_name": "TeamViewer GmbH", "certificate_thumbprint": "N/A", "tbs_sha256": "", "tbs_sha1": "8A32858C446E0F681927B02BECA029F854B98D31" }, { "signer_name": "TeamViewer Germany GmbH", "certificate_thumbprint": "777A41024CF413CCB49B3434565545C0D78D80E9", "tbs_sha256": "290C3846B4E52E99DD2B7E5FA600BDB51972D7A3CFD37BA67AC1ED362CC1CA93", "tbs_sha1": "", "certificate_der_base64": "MIIHfDCCBWSgAwIBAgIQBi7j/XzcUgl8HaavqHx0XjANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIzMDUwNDAwMDAwMFoXDTI2MDUwNjIzNTk1OVowgYMxCzAJBgNVBAYTAkRFMRswGQYDVQQIDBJCYWRlbi1Xw7xydHRlbWJlcmcxEzARBgNVBAcMCkfDtnBwaW5nZW4xIDAeBgNVBAoTF1RlYW1WaWV3ZXIgR2VybWFueSBHbWJIMSAwHgYDVQQDExdUZWFtVmlld2VyIEdlcm1hbnkgR21iSDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK7Wp0z09VeTK0qXFBFiU7dKqkMDDV3/Y2wodsiBfGrXmxGyBadZg2B7M8o64PXcSx2PTxpnJ0/K4YRKepnFmgH2/AIaF10sr/xtP3HVG0fbbw7SLymnPgf8cfLd4CpM1zQs7NLyxVVCMSRInc4oKoMEIU2dxYXQJPfk29I3BiU2/3MAmUTA6TnOw5RvltOjtcO1Kxl6dtRmmf/nOtzZSnkK91HxvEO5bTWNuu2nD/LvLTI6RelGIzCh6ruFNNidf0t0NiA6+EleQKLOX1BeeLF9RcuNaadLS/ExbhnfcEPiu1TOizqaZJdJPRescb5VFtJcK5mQLoW68/FU98pXbTGZ3yRfpCaCZSyTDw4LU+dobAi6ZpGnI4oSMHBQB8um3YGQB5Bn7W3aPCXTXWAVQASW8rs598jgLaEDcrRmuPSl2Tj3YDyYFmim87VtTgg6rZ9paq/iGhxPgOaom/IGxMk6dXy4218fCIiKLRsGmN/2MX1/qdHQopwfI3jgreLaMgMD9RUVLIrUBn1ebihal+8GXYp7TzsobKgorxcqAFyBiGqZHrDWq8gOKiJAL+V4qF9/yPZlnPGVmVbhsvkLtXbD/2JVDp0oxjVtZUOtQCHKOPc8Tp2ox0U3ZOEXJePCPGAdUnXFKRme6oLUTgo3N2TorhzkdgmM0Y3Asr03RgxrAgMBAAGjggIDMIIB/zAfBgNVHSMEGDAWgBRoN+Drtjv4XxGG+/5hewiIZfROQjAdBgNVHQ4EFgQUEDJETPaHVJYpbFLHmoOkDlmx0hcwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMIG1BgNVHR8Ega0wgaowU6BRoE+GTWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMFOgUaBPhk1odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDA+BgNVHSAENzA1MDMGBmeBDAEEATApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggIBAMT8yjyb7RvcLWYR0qWbvJBou3ZunFrs+Cu+YJHjCe9GnZKZJZjKP+Oe/h7J0sZCyCMIh2bvmcDW36fWQ8uw5nxS88Vxr/BGHlaXzk5H94xKrqPE7d0/IxlxqMQsgBlPWgIiRlEWl+ITITkKCnpx3/F4O6Ieoy7oZ9pvE1ta9LJZ5jspBFARg0N4WTF1HhBRIqL6DiemuWo7dPyLIw5M2/kWLQkQL9KVAqch1DCNvXXwwm8Dwajc3ARrn58a6Tqn8j+wDxvyVmsjJLIPsYKeP93l4aiJEl8HHbE0h64Frzrh0lDG3p+bJML0PlRtDCp1YES5baCuEzWDI5rRBggR6llW2TsKtbnIBdKkK2a+/GF3b1YFofFpbDTRW1V/YkKwN3qhadTz0f2sYmWRf57IgRolyB3A+KDd2Bl0NnTAzvAbU31rtLi8Wmgah3LtoQx6qN/1I4HAOUp94j89PQDoQsyJkkHhQxtYQ7VO8yy/pEeXC4byd3V5Q86spB7flqFFB9IuG9LJV8+j+VjFxzOUsX8QWSgXMFA254Ianp11guEBuYeom/oWVUsRCo+NKkmsIs5G7Dq9YJe+9PgGr1XbQEU+L3YjK528yAWzWxSZlBDUYx7WBdbQVC9AN4uSpu9ySJb+Fg4S/viev9pXhHQORmv1BTeYzC9KgRmAu9lT/MTQ" }, { "signer_name": "TeamViewer Germany GmbH", "certificate_thumbprint": "N/A", "tbs_sha256": "", "tbs_sha1": "EA00EEBFABBB1D7DB243AFE1349D536A812B0EBF" }, { "signer_name": "TeamViewer Germany GmbH", "issuer": "CN=DigiCert Assured ID Code Signing CA-1", "certificate_thumbprint": "05CDF79B0EFFFF361DAC0363ADAA75B066C49DE0", "tbs_sha256": "DFD5337289D8F9FC748CCC9A7DC597EEEFEA7ABEA5AF736AFFD09CAC8145AADB", "tbs_sha1": "EA00EEBFABBB1D7DB243AFE1349D536A812B0EBF", "valid_from": "2019-12-19T00:00:00+00:00", "valid_to": "2020-12-23T12:00:00+00:00", "certificate_der_base64": "MIIFODCCBCCgAwIBAgIQC0RlRsNlJb9fCE9ru7pwlzANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMS4wLAYDVQQDEyVEaWdpQ2VydCBBc3N1cmVkIElEIENvZGUgU2lnbmluZyBDQS0xMB4XDTE5MTIxOTAwMDAwMFoXDTIwMTIyMzEyMDAwMFowgYMxCzAJBgNVBAYTAkRFMRswGQYDVQQIDBJCYWRlbi1Xw7xydHRlbWJlcmcxEzARBgNVBAcMCkfDtnBwaW5nZW4xIDAeBgNVBAoTF1RlYW1WaWV3ZXIgR2VybWFueSBHbWJIMSAwHgYDVQQDExdUZWFtVmlld2VyIEdlcm1hbnkgR21iSDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMcqqJLw4L0qx5sjN0U+fU8WKvcmcaDU6x2B/x09HhGADDmKnQT6a2R5oILpyfP8txpNLh15CfLbqJzGpuwt3x70EfkwrzKOpMF9inF5d8NkBCrPmO/VufYkXFm7j2H36IcNby861sIkvpvuafXJfaesGACug9iHIFWSrKAh9HTLlu7cGogKdbcyEFxu6HD1WfGyItxoFMJwLlw+ONvmZjDIFwb73OSgDNLGXwahlso+dIwP4yaZDdIcNXjJyC8xB0i20rppLRBWssirx2Q3Ja8f09i8ZjG3YhCjjp75sefmiQuHP6omrf9UFvLEdkTIx/Mfh+h3Q6nqhXwC3Og4YtUCAwEAAaOCAbkwggG1MB8GA1UdIwQYMBaAFHtozimqwBe+SXrh5T/Wp/dFjzUyMB0GA1UdDgQWBBQemA9KE41CNOyylIvvnMNsgYdCDzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwbQYDVR0fBGYwZDAwoC6gLIYqaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL2Fzc3VyZWQtY3MtZzEuY3JsMDCgLqAshipodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vYXNzdXJlZC1jcy1nMS5jcmwwTAYDVR0gBEUwQzA3BglghkgBhv1sAwEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAIBgZngQwBBAEwgYIGCCsGAQUFBwEBBHYwdDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEwGCCsGAQUFBzAChkBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURDb2RlU2lnbmluZ0NBLTEuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEFBQADggEBAJiUqjo3HgTXEslNHeWVo8FmL2NxojGVA1bV6QesGGtsvC/xR+rt00AncybotwYpLh2fJroBL+ou+1OM6L9ZSyttGT26PBEIijl8uXf0/Ve7LHrNGjhm5sCQQSjYpc9Af5qzEZzyiMAhbYBUvcQSHJbT4ljBnTPlIignpwF3A7AO8R1CU3nUuV20Q12pvlY3SY0ZROJKNhjWlzeistdvPrwywWwpS376fCJFFEtmkifiomeYqqP6I/TZw6T7upbstmSOFiO4GdPLiF81d5s3vkbdMjhdkrGM6YX//Ke1QUntO6JSBkM1d9G74b0BmI+rw2bAJkqshT7AWp1FtDXvkM0=" }, { "signer_name": "TeamViewer GmbH", "issuer": "CN=DigiCert Assured ID Code Signing CA-1", "certificate_thumbprint": "7709C8FE112562666C7AC973E43831BA9FADBB54", "tbs_sha256": "454E97CEB89961E5C52E60CC9D4E231DE06BF61747113B90850819EE1EBE19E0", "tbs_sha1": "8A32858C446E0F681927B02BECA029F854B98D31", "valid_from": "2019-02-11T00:00:00+00:00", "valid_to": "2019-12-31T12:00:00+00:00", "certificate_der_base64": "MIIFJzCCBA+gAwIBAgIQA0ceLIFxsWediYrBm9o3uzANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMS4wLAYDVQQDEyVEaWdpQ2VydCBBc3N1cmVkIElEIENvZGUgU2lnbmluZyBDQS0xMB4XDTE5MDIxMTAwMDAwMFoXDTE5MTIzMTEyMDAwMFowczELMAkGA1UEBhMCREUxGzAZBgNVBAgMEkJhZGVuLVfDvHJ0dGVtYmVyZzETMBEGA1UEBwwKR8O2cHBpbmdlbjEYMBYGA1UEChMPVGVhbVZpZXdlciBHbWJIMRgwFgYDVQQDEw9UZWFtVmlld2VyIEdtYkgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMsAyUaLQR03F43NaHWo/u7kk6EgFhWj4PdW/AapZjBt517W5jID9vknMInL0qzSrhUlE4gGuLvKehbq4xOhzzyF3jawPBHpHW8l15lzIY9aDZJkgE8uV0Q3d4zWBE0meWDmOuWem6P87yJmeHkFCjXENMUW2W250aNGJkZVj0bYriU9QOBm3mi5bvIk3pTTdtNFQYh7RXUKen/oVqDJoZAbCmjiAaQL5/QgV6+ydHV69kLRTrBaKh3cmzw0L+TWKCvYwyJbh2P89ARpRQfQu5Jo898BUwpAyatNjDxSgVzYHPUKt+y4obcTa2Zai4wnqWfpv4QBVNky9giqkqu2lVAgMBAAGjggG5MIIBtTAfBgNVHSMEGDAWgBR7aM4pqsAXvkl64eU/1qf3RY81MjAdBgNVHQ4EFgQUBabcs0VUnnel6U/ewh+SVWd44x4wDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMG0GA1UdHwRmMGQwMKAuoCyGKmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9hc3N1cmVkLWNzLWcxLmNybDAwoC6gLIYqaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL2Fzc3VyZWQtY3MtZzEuY3JsMEwGA1UdIARFMEMwNwYJYIZIAYb9bAMBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQQBMIGCBggrBgEFBQcBAQR2MHQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBMBggrBgEFBQcwAoZAaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ29kZVNpZ25pbmdDQS0xLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBQUAA4IBAQB3u+UjW0mRt6JMEuFOmEH46nwYTx5FWnnnEg92qkDfw/fX1EAkcyfPjbwSAwg9V0It+DerJraqzMBHpCp7UZkWf9XLSikrg30OKnwGfS5xVLReK+RUmgfsVVmV2hwQcmFtEXUPcNcXJbJtd7QagyyrdXB5eKCnKlNvnTKB91TSBidOliTZlqixBs/SUu+ACzpugs06xsFUaGyY9YJVqbj4Y+4pVHO3i5hKEujTK2dbhiiKJDJdFmonx3FemtWMsnvhywpPv739NvcLy2+1kmPrY/RhKU0pfniXAXM725MbsDopGI906ZfU3V2x3EOpcrLVvbYIUA4+N2RURdV4erKR" } ] } }