diamondfox

General

Target

02b4623f56f979b9082818d613cac29a56aba763288eacaee74e063469aca61b
Size

3.3MB
Sample

220223-azgqnafgg5
MD5

77ab7e4dc7dcc201aabca121245d37de
SHA1

05276c0f69e0cb1b0acfd125604eaa703d442f30
SHA256

02b4623f56f979b9082818d613cac29a56aba763288eacaee74e063469aca61b
SHA512

307e460a5fb0c06b44beea2e826d89434a71daba30210efd558d1b0a6b2b8fb75171d1d064c2703e1297c032fb8eb84a3c77c08747b2b5483017d648331d4b0b

Score

10^/10

Malware Config

Targets

- Target
  
  02b4623f56f979b9082818d613cac29a56aba763288eacaee74e063469aca61b
- Size
  
  3.3MB
- MD5
  
  77ab7e4dc7dcc201aabca121245d37de
- SHA1
  
  05276c0f69e0cb1b0acfd125604eaa703d442f30
- SHA256
  
  02b4623f56f979b9082818d613cac29a56aba763288eacaee74e063469aca61b
- SHA512
  
  307e460a5fb0c06b44beea2e826d89434a71daba30210efd558d1b0a6b2b8fb75171d1d064c2703e1297c032fb8eb84a3c77c08747b2b5483017d648331d4b0b
Score

10^/10

diamondfox botnet macro persistence stealer
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- DiamondFox stealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

DiamondFox stealer

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Executes dropped EXE

Suspicious Office macro

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2