Resubmissions

29/08/2023, 03:06

230829-dl7ayacf9110

01/07/2022, 14:18

220701-rmjg6ahdd610

General

  • Target
    3ef2a739073edef534d6bbd2c426cf8e2285544d03afe33ce64526f3e5926248
  • Size 312KB
  • Sample220701-rmjg6ahdd6
  • SHA256 3ef2a739073edef534d6bbd2c426cf8e2285544d03afe33ce64526f3e5926248
  • MD5 SHA1 SHA512

Malware Config

Targets

    • Target
      3ef2a739073edef534d6bbd2c426cf8e2285544d03afe33ce64526f3e5926248
    • Size 312KB
    • SHA256 3ef2a739073edef534d6bbd2c426cf8e2285544d03afe33ce64526f3e5926248
    • MD5 SHA1 SHA512
    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks