I generated the following traffic from fake TeamViewer infections this week: The fake TeamViewer page and URL to download the. online domain changed multiple times each day.

The 'Download Now' buttons on the fake TeamViewer page retrieved a malicious JavaScript (.js) file from the following URL: The URL redirected to a fake TeamViewer page hosted on a compromised server at dogotungtamcom. That URL redirected to a malicious URL from. hxxps://clickserve.dartsearchnet/link/click?&ds_dest_url=hxxps://baherlakerlonline/z7ND1tqY?.The above URL returned a HTTP/1.1 302 Found, with a location of: saz file revealed the following Google Ad Services link:

I saved the Fiddler capture as a Session Archive Zip (.saz) file. However, data from the cache wasn't complete, so I recorded a second run using Telerik's Fiddler web debugging proxy tool. I recorded a packet capture (pcap) of the first run and used Google Cache Viewer to review the ad traffic from the Microsoft Edge browser cache. Shown above: Fake TeamViewer page provided a file named TeamViewer_Setup.js. Shown above: Google ad that led to the fake TeamViewer page. The following screenshots show a Google ad that led to the fake TeamViewer page. Shown above: Flow of events from this infection chain. This week's infection involved a downloaded JavaScript (.js) file that led to Microsoft Installer packages (.msi files) containing other script that used free or open source programs. This week, the same type of ad traffic led to a fake TeamViewer page, and that page led to a different type of malware. Earlier this month, I wrote a diary about Google ad traffic leading to a fake AnyDesk page pushing IcedID malware.

Teamviewer msi