diamondfox | aee8df317acf19c8b0645de2ad4595d85281eeaeaf5b9b8f8786c647f8365de9 | Triage

Submit
Reports

Overview

overview

Static

static

aee8df317a...e9.exe

windows7-x64

aee8df317a...e9.exe

windows10-2004-x64

Sharing

General

Target

aee8df317acf19c8b0645de2ad4595d85281eeaeaf5b9b8f8786c647f8365de9
Size

569KB
Sample

220731-frpn7ahed9
MD5

1da9a3e209139bef422041960aba6464
SHA1

00f40230e43aeabb7ef3fb3332a29b59e95e24f9
SHA256

aee8df317acf19c8b0645de2ad4595d85281eeaeaf5b9b8f8786c647f8365de9
SHA512

f9d8c905ff143dac5b95be12afd21698795211a639b2977fa0f993221bf2ee86cc1eb8253433dda8e70c58ee559b92d094c75d8750cfa7ed7e1f7316b8621f23

Score

10^/10

diamondfox botnet infostealer stealer upx

Static task

static1

Behavioral task

behavioral1

Sample

aee8df317acf19c8b0645de2ad4595d85281eeaeaf5b9b8f8786c647f8365de9.exe

Resource

win7-20220715-en

diamondfox botnet infostealer stealer upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

aee8df317acf19c8b0645de2ad4595d85281eeaeaf5b9b8f8786c647f8365de9.exe

Resource

win10v2004-20220721-en

diamondfox botnet infostealer stealer upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  aee8df317acf19c8b0645de2ad4595d85281eeaeaf5b9b8f8786c647f8365de9
- Size
  
  569KB
- MD5
  
  1da9a3e209139bef422041960aba6464
- SHA1
  
  00f40230e43aeabb7ef3fb3332a29b59e95e24f9
- SHA256
  
  aee8df317acf19c8b0645de2ad4595d85281eeaeaf5b9b8f8786c647f8365de9
- SHA512
  
  f9d8c905ff143dac5b95be12afd21698795211a639b2977fa0f993221bf2ee86cc1eb8253433dda8e70c58ee559b92d094c75d8750cfa7ed7e1f7316b8621f23
Score

10^/10

diamondfox botnet infostealer stealer upx
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- DiamondFox payload
  Detects DiamondFox payload in file/memory.
  infostealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

diamondfoxbotnetinfostealerstealerupx

behavioral2

diamondfoxbotnetinfostealerstealerupx

© 2018-2024

Terms | Privacy