diamondfox | 6be9854eb0b6947a78840f089509c349a4768056970bfe75b1c6322cc95d955b

Reason

config extraction: NanoCore: EOF

General

Target
6be9854eb0b6947a78840f089509c349a4768056970bfe75b1c6322cc95d955b
Size 1.4MB
Sample220209-mjt29saab2
SHA256 6be9854eb0b6947a78840f089509c349a4768056970bfe75b1c6322cc95d955b
MD5 8e3f4c4bdfe28f82b99d7f83175e4371
SHA1 d20a5328202d74ac4789f1b67692dc9bdc62cc62
SHA512 885771d277da27095f1b9c510abeb9c993a199f12307db919783262512a81d19257b825fab776ff2db59d50537388c68cde74239fb0a5c68bb4b29c631a3b0ea
SSDEEP 24576:7MWHiFDV07ECXo4tu619SbX7ZwwjeJJV+CBqAKngOu8LNZZ/LJCPlyPlVF:WJ6qbroCnlu8jhL0PMtVF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pyinstaller diamondfox

Malware Config

Signatures

DiamondFox stealer 1 IoCs

resource	yara_rule
sample	diamondfox_stealer

Diamondfox family
diamondfox

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

File Explorer

6be9854eb0b6947a78840f089509c349a4768056970bfe75b1c6322cc95d955b

.exe 1.4MB

6be9854eb0b6947a78840f089509c349a4768056970bfe75b1c6322cc95d955b

IMPHASH 6dfd283212216123373d6f57e66e4ef4
SHA256 6be9854eb0b6947a78840f089509c349a4768056970bfe75b1c6322cc95d955b
MD5 8e3f4c4bdfe28f82b99d7f83175e4371
SHA1 d20a5328202d74ac4789f1b67692dc9bdc62cc62
SHA512 885771d277da27095f1b9c510abeb9c993a199f12307db919783262512a81d19257b825fab776ff2db59d50537388c68cde74239fb0a5c68bb4b29c631a3b0ea
SSDEEP 24576:7MWHiFDV07ECXo4tu619SbX7ZwwjeJJV+CBqAKngOu8LNZZ/LJCPlyPlVF:WJ6qbroCnlu8jhL0PMtVF
MD5 SHA1 SHA512 SSDEEP

windows x64

DiamondFox stealer
Detects Pyinstaller

pyinstaller

Minor OS version

Major OS version

Entry point

6951

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExpandEnvironmentStringsW CreateFileW WriteFile CloseHandle LoadResource LockResource SizeofResource FindResourceA FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetModuleFileNameA ExitProcess GetModuleHandleExW GetACP GetCurrentThread OutputDebugStringA OutputDebugStringW WaitForSingleObjectEx CreateThread FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetFileType GetStringTypeW SetConsoleCtrlHandler HeapSize HeapReAlloc WriteConsoleW

ole32

CoCreateInstance CoUninitialize CoInitialize

Name

.text

Size

366KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

977B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

File Explorer

6be9854eb0b6947a78840f089509c349a4768056970bfe75b1c6322cc95d955b

kernel32

ole32