Extracted

• • Target

    setup.exe

  • Size

    90KB

  • MD5

    1d5b46ff3cd12fd31362557299d6f488

  • SHA1

    42f5d828b03f5e4c03e9f935683b5d82e6e7dc26

  • SHA256

    2f134d1467c3765898a1befc311b86414f8df96d307a6f05b23eebbb8866a69c

  • SHA512

    4dd2071b369bd150da53446313fff30b08054b8724a02444c400db2f0b14062c51a5aff2390b1845cc87b629ffc77ecc5e72877f77f824553b6f68a7b39a9d23

  Score

  10^/10

  diamondfoxbotnetdiscoveryspywarestealer

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

    botnetstealerdiamondfox

  • DiamondFox payload

    Detects DiamondFox payload in file/memory.

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2