Resubmissions

09-04-2024 09:25

240409-ld13ysbf56 10

04-03-2021 15:00

210304-4rkckgcr1n 10

General

  • Target

    a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin

  • Size

    90KB

  • Sample

    210304-4rkckgcr1n

  • MD5

    387fd80a5602adc3dd4b2d0197a289de

  • SHA1

    b903356e121f997a49759b306533a7ee8880b13b

  • SHA256

    a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc

  • SHA512

    3d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e

Malware Config

Extracted

Family

diamondfox

C2

http://dong7707.at/spt/gate.php

Mutex

YxgnVQE8PlVLcflLlW4ai9xmX2DERyF4

xor.plain

Targets

    • Target

      a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc.bin

    • Size

      90KB

    • MD5

      387fd80a5602adc3dd4b2d0197a289de

    • SHA1

      b903356e121f997a49759b306533a7ee8880b13b

    • SHA256

      a6375022953679ad82fc634b471c5b9b7911b47453e8d155469f24ee20db89dc

    • SHA512

      3d8d5f437df25d23dbba75c4be7d252bdda32e84c1c55eee10877d38a178aed5beae6dbb56c1f0aa7ba9a94c020dc0705584bdc13bfe61d0af4de9cc76afa23e

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks