SearchIndexer.exe

General
Target

SearchIndexer.exe

Size

91KB

Sample

200812-vc8ftkz17s

Score
10 /10
MD5

1cc07a0274718e845c9b77f8334c4cb3

SHA1

12b6c08371fd4661ed2da442e7ec34f226d7ac01

SHA256

b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf

SHA512

0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d

Malware Config

Extracted

Family diamondfox
C2

http://timesync.live/panel/gate.php

http://cartierxs.bit/panel/gate.php

http://salamsa.bit/panel/gate.php

http://rockababy.bit/panel/gate.php

http://minon.bit/panel/gate.php

http://bloxfox.bit/panel/gate.php

http://ggbbee.bit/panel/gate.php

http://locksock.bit/panel/gate.php

http://misosoup.bit/panel/gate.php

http://opseckes.bit/panel/gate.php

http://googletabmanager.com/panel/gate.php

xor.plain
Targets
Target

SearchIndexer.exe

MD5

1cc07a0274718e845c9b77f8334c4cb3

Filesize

91KB

Score
10 /10
SHA1

12b6c08371fd4661ed2da442e7ec34f226d7ac01

SHA256

b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf

SHA512

0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d

Tags

Signatures

  • DiamondFox

    Description

    DiamondFox is a multipurpose botnet with many capabilities.

    Tags

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Tasks

                      static1

                      10/10

                      behavioral1

                      10/10

                      behavioral2

                      10/10