diamondfox | 40cd3ee8561842ec1780e81a6833f17dab2189f2cd6885f3d8291106508a019d | Triage

Sharing

General

Target

40cd3ee8561842ec1780e81a6833f17dab2189f2cd6885f3d8291106508a019d
Size

18KB
Sample

220708-ldql8abcbl
MD5

2878d36d310c8195df391ca5b4dc4a18
SHA1

7f6c436cde7e133abe38c99a9a2ecbccbe9c6c0a
SHA256

40cd3ee8561842ec1780e81a6833f17dab2189f2cd6885f3d8291106508a019d
SHA512

47cdab2668ba96606c784ccb68ba9ae0f03488db4b9d17a51aa9f1a176e8daf06fca7c2c2ba474b5d140a05221eb27d9cc7670ed149b4b41a5d31a3e3ec3a3a3

Score

10^/10

diamondfox botnet evasion persistence stealer trojan

Malware Config

Targets

- Target
  
  40cd3ee8561842ec1780e81a6833f17dab2189f2cd6885f3d8291106508a019d
- Size
  
  18KB
- MD5
  
  2878d36d310c8195df391ca5b4dc4a18
- SHA1
  
  7f6c436cde7e133abe38c99a9a2ecbccbe9c6c0a
- SHA256
  
  40cd3ee8561842ec1780e81a6833f17dab2189f2cd6885f3d8291106508a019d
- SHA512
  
  47cdab2668ba96606c784ccb68ba9ae0f03488db4b9d17a51aa9f1a176e8daf06fca7c2c2ba474b5d140a05221eb27d9cc7670ed149b4b41a5d31a3e3ec3a3a3
Score

10^/10

diamondfox botnet evasion persistence stealer trojan
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

diamondfoxbotnetevasionpersistencestealertrojan

behavioral2

diamondfoxbotnetevasionpersistencestealertrojan