Overview

overview

10

Static

static

DRAFT HBL ...SO.scr

windows7_x64

10

DRAFT HBL ...SO.scr

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件 林瑞-1090715-7383-SO.scr
  • Size 573KB
  • Sample200716-fsa1t7nb5j
  • SHA256 f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519
  • MD5 SHA1 SHA512
Score
10/10
diamondfoxbotnetstealer

Malware Config

Targets

    • Target
      DRAFT HBL 2007106 林瑞 TO NEW DELHI SO NO. 7383 CLOSING 07-20 正在寄送電子郵件 林瑞-1090715-7383-SO.scr
    • Size 573KB
    • SHA256 f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519
    • MD5 SHA1 SHA512
    Score
    10/10
    diamondfoxbotnetstealer

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks