Overview

overview

10

Static

static

10

SearchIndexer.exe

windows10_x64

10

Resubmissions

01/06/2022, 14:27

220601-rskbmshbg5

19/09/2021, 03:58

210919-ejryxachcm10

19/09/2021, 01:27

210919-bvbjhscgel10

19/09/2021, 01:24

210919-bsvvdaaba910

12/08/2020, 13:47

200812-vc8ftkz17s10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SearchIndexer.exe
  • Size 91KB
  • Sample210919-ejryxachcm
  • SHA256 b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
  • MD5 SHA1 SHA512
Score
10/10
diamondfoxbotnetstealer

Malware Config

Extracted

Family

  • diamondfox

C2

  • http://timesync.live/panel/gate.php

  • http://cartierxs.bit/panel/gate.php

  • http://salamsa.bit/panel/gate.php

  • http://rockababy.bit/panel/gate.php

  • http://minon.bit/panel/gate.php

  • http://bloxfox.bit/panel/gate.php

  • http://ggbbee.bit/panel/gate.php

  • http://locksock.bit/panel/gate.php

  • http://misosoup.bit/panel/gate.php

  • http://opseckes.bit/panel/gate.php

  • http://googletabmanager.com/panel/gate.php

Mutex

  • cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS

xor.plain

Targets

    • Target
      SearchIndexer.exe
    • Size 91KB
    • SHA256 b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
    • MD5 SHA1 SHA512
    Score
    10/10
    diamondfoxbotnetstealer

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks