diamondfox | d465d2029b83316e613de8adbe16ea69fb561eecabb268781e038c216a2cb421 | Triage

Sharing

General

Target

loader.exe
Size

76KB
Sample

240718-nlvl9azclg
MD5

326c9824559847fb07129398ba61d8f6
SHA1

4fd07eca43b61b77767256d55aab05c413713866
SHA256

d465d2029b83316e613de8adbe16ea69fb561eecabb268781e038c216a2cb421
SHA512

eb69406130c2028258475af1f992f79151e1b797918bf71d73ff8fb2b9562bdc5114033177e4c31f5a1f52f8a613e7aaa5d7bee233a2e28146fe702c29192aac
SSDEEP

768:v7XINhXznVJ8CC1rBXdo0zekXUd3CdPJxB7mNmDZkUKMKZQbFTiKKAZTch:ShT8C+fuioHq1KEFoAS

Score

10^/10

diamondfox botnet evasion persistence stealer trojan

Malware Config

Targets

- Target
  
  loader.exe
- Size
  
  76KB
- MD5
  
  326c9824559847fb07129398ba61d8f6
- SHA1
  
  4fd07eca43b61b77767256d55aab05c413713866
- SHA256
  
  d465d2029b83316e613de8adbe16ea69fb561eecabb268781e038c216a2cb421
- SHA512
  
  eb69406130c2028258475af1f992f79151e1b797918bf71d73ff8fb2b9562bdc5114033177e4c31f5a1f52f8a613e7aaa5d7bee233a2e28146fe702c29192aac
- SSDEEP
  
  768:v7XINhXznVJ8CC1rBXdo0zekXUd3CdPJxB7mNmDZkUKMKZQbFTiKKAZTch:ShT8C+fuioHq1KEFoAS
Score

10^/10

diamondfox botnet evasion persistence stealer trojan
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- DiamondFox stealer
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

diamondfoxbotnetevasionpersistencestealertrojan

behavioral2

diamondfoxbotnetevasionpersistencestealertrojan