General

  • Target

    SecuriteInfo.com.Variant.Fugrafa.133115.17408.5029

  • Size

    203KB

  • Sample

    210704-ghtvxkcyz2

  • MD5

    a1e165e1926c0c83123c89fce6b1af56

  • SHA1

    281246ba4b852a5f62e032424f7816f5a6b0406f

  • SHA256

    2d64df6be5fbabdd41d304644e18d6dcab3d1a889df58fa962111e1c76ad2215

  • SHA512

    28e2081e6249378e7f81e46e8e4afc93828adca7cf51316e7060655a60b2ee90b6f22af0b45a23299368d821816a64bc9d02d18f69d296047604f51b12eba354

Malware Config

Targets

    • Target

      SecuriteInfo.com.Variant.Fugrafa.133115.17408.5029

    • Size

      203KB

    • MD5

      a1e165e1926c0c83123c89fce6b1af56

    • SHA1

      281246ba4b852a5f62e032424f7816f5a6b0406f

    • SHA256

      2d64df6be5fbabdd41d304644e18d6dcab3d1a889df58fa962111e1c76ad2215

    • SHA512

      28e2081e6249378e7f81e46e8e4afc93828adca7cf51316e7060655a60b2ee90b6f22af0b45a23299368d821816a64bc9d02d18f69d296047604f51b12eba354

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Tasks