diamondfox | 48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e | Triage

Sharing

General

Target

48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e
Size

216KB
Sample

220714-ejectacden
MD5

670497e6310600fe3149d128946cf9df
SHA1

82a807efec4d2751e0834f5605e13001c6450841
SHA256

48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e
SHA512

4a631b40b65622206ed7f8afebab255f33d54486b377f33c428ddda98f6e1a27bed003c021fae06faafe5df063f835f4f9ddb194d89966eae2447e53e6c32090

Score

10^/10

diamondfox botnet evasion persistence stealer trojan

Malware Config

Targets

- Target
  
  48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e
- Size
  
  216KB
- MD5
  
  670497e6310600fe3149d128946cf9df
- SHA1
  
  82a807efec4d2751e0834f5605e13001c6450841
- SHA256
  
  48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e
- SHA512
  
  4a631b40b65622206ed7f8afebab255f33d54486b377f33c428ddda98f6e1a27bed003c021fae06faafe5df063f835f4f9ddb194d89966eae2447e53e6c32090
Score

10^/10

diamondfox botnet evasion persistence stealer trojan
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

diamondfoxbotnetevasionpersistencestealertrojan