Overview

overview

10

Static

static

f771b27722...19.exe

windows7_x64

10

f771b27722...19.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe

  • Size

    573KB

  • Sample

    200716-ncytwybgnj

  • MD5

    72bb8e802c14c18dc8822db3b15d6e38

  • SHA1

    ca47292b04a271bc7dbb09cf8bb966eaa478783d

  • SHA256

    f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519

  • SHA512

    f623bdad2e2a259bc4ddc2ba35b7f81c3380e39bcdfdc86506ce22ca717cd223904c30bd48a400319c3e6197bf885fefc1503967b9815e7d734de2d96220332c

Score
10/10
diamondfoxbotnetstealer

Malware Config

Targets

    • Target

      f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519.exe

    • Size

      573KB

    • MD5

      72bb8e802c14c18dc8822db3b15d6e38

    • SHA1

      ca47292b04a271bc7dbb09cf8bb966eaa478783d

    • SHA256

      f771b277221c7b1f569e44b18537b50f406f236412f57e04a9a5cc54f072e519

    • SHA512

      f623bdad2e2a259bc4ddc2ba35b7f81c3380e39bcdfdc86506ce22ca717cd223904c30bd48a400319c3e6197bf885fefc1503967b9815e7d734de2d96220332c

    Score
    10/10
    diamondfoxbotnetstealer

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks