Overview

overview

10

Static

static

10

atiedxx.exe

windows7-x64

10

atiedxx.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    atiedxx.bin

  • Size

    90KB

  • Sample

    231124-3nvscsga4v

  • MD5

    4dddf0bfbb7fff60a92926426a0754e4

  • SHA1

    423f4f6b9c0805222b9577b52862af684030c002

  • SHA256

    f24b905fb50dd08805caa0d357b3c43149a5174c745797af98d0c4f111f85788

  • SHA512

    713fec6b0a8067dd39579ad9280442bf215efb95b628e9b2f3cdb61fb4bc796bfb2857810fe393757a25006ba7203878ce9c4763ed15db6d8a5785badbc21744

  • SSDEEP

    1536:Y4VCaYZdr/Wl2pB6mOL1fNzsqGzLkGkRQZbK:YyPYylOBU5VzMkRQK

Score
10/10
diamondfoxbotnetinfostealerstealer

Malware Config

Targets

    • Target

      atiedxx.bin

    • Size

      90KB

    • MD5

      4dddf0bfbb7fff60a92926426a0754e4

    • SHA1

      423f4f6b9c0805222b9577b52862af684030c002

    • SHA256

      f24b905fb50dd08805caa0d357b3c43149a5174c745797af98d0c4f111f85788

    • SHA512

      713fec6b0a8067dd39579ad9280442bf215efb95b628e9b2f3cdb61fb4bc796bfb2857810fe393757a25006ba7203878ce9c4763ed15db6d8a5785badbc21744

    • SSDEEP

      1536:Y4VCaYZdr/Wl2pB6mOL1fNzsqGzLkGkRQZbK:YyPYylOBU5VzMkRQK

    Score
    10/10
    diamondfoxbotnetinfostealerstealer

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox

    • DiamondFox payload

      Detects DiamondFox payload in file/memory.

      infostealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks