diamondfox | ad9ad8c5e78a1060cddb589a027ed9ac6f8ef8fbaa88862e9269690a4fe49283 | Triage

Submit
Reports

Overview

overview

Static

static

8eda529979...18.exe

windows7-x64

8eda529979...18.exe

windows10-2004-x64

Sharing

General

Target

8eda529979d30636fb0fbb45c2da7977_JaffaCakes118
Size

76KB
Sample

240602-vz3ncahe41
MD5

8eda529979d30636fb0fbb45c2da7977
SHA1

c8894ae2dc2d6f0225c72a2b19fb283a57f077fe
SHA256

ad9ad8c5e78a1060cddb589a027ed9ac6f8ef8fbaa88862e9269690a4fe49283
SHA512

537a16d8dc253800d5225ee1f41135fe619df6c26491fe203632d385751f57a2aa8da5cd9bd4c6582b2f579751ce245aeea367fe106a90058a332d768982d44c
SSDEEP

768:/7XINhXznVJ8CC1rBXdo0zekXUd3CdPJxB7mNmDZkUKMKZQbFTiKKAZTX:ChT8C+fuioHq1KEFoAF

Score

10^/10

diamondfox botnet evasion stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

8eda529979d30636fb0fbb45c2da7977_JaffaCakes118.exe

Resource

win7-20240508-en

diamondfox botnet evasion stealer trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

8eda529979d30636fb0fbb45c2da7977_JaffaCakes118.exe

Resource

win10v2004-20240426-en

diamondfox botnet evasion stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  8eda529979d30636fb0fbb45c2da7977_JaffaCakes118
- Size
  
  76KB
- MD5
  
  8eda529979d30636fb0fbb45c2da7977
- SHA1
  
  c8894ae2dc2d6f0225c72a2b19fb283a57f077fe
- SHA256
  
  ad9ad8c5e78a1060cddb589a027ed9ac6f8ef8fbaa88862e9269690a4fe49283
- SHA512
  
  537a16d8dc253800d5225ee1f41135fe619df6c26491fe203632d385751f57a2aa8da5cd9bd4c6582b2f579751ce245aeea367fe106a90058a332d768982d44c
- SSDEEP
  
  768:/7XINhXznVJ8CC1rBXdo0zekXUd3CdPJxB7mNmDZkUKMKZQbFTiKKAZTX:ChT8C+fuioHq1KEFoAF
Score

10^/10

diamondfox botnet evasion stealer trojan
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- DiamondFox stealer
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

diamondfoxbotnetevasionstealertrojan

behavioral2

diamondfoxbotnetevasionstealertrojan

© 2018-2024

Terms | Privacy