diamondfox | 0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8 | Triage

Submit
Reports

Overview

overview

Static

static

3

c8830b9e61...18.exe

windows7-x64

c8830b9e61...18.exe

windows10-2004-x64

Sharing

General

Target

c8830b9e611ef52f5d4dcddee87c2ba1_JaffaCakes118
Size

231KB
Sample

240829-kschgasfmd
MD5

c8830b9e611ef52f5d4dcddee87c2ba1
SHA1

fc7f516a1cc9916405e1f15f0be2432b356efe86
SHA256

0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8
SHA512

dca8de414cf9d841283184931d9977a299ad7ac47019330a464c10a69e2e9c98131c2e7cfdb658494c1f32975efde3f58128f2fcaad1046c8f495b6af8d845a9
SSDEEP

3072:JvOR1bc6l7Z/nJEpq/i8vJiEXQwd6yk0MD0feO4MuTrRn8XmLJhVsPH:V4DJX/zrrv4M3WLJAf

Score

10^/10

diamondfox botnet discovery execution infostealer stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c8830b9e611ef52f5d4dcddee87c2ba1_JaffaCakes118.exe

Resource

win7-20240704-en

diamondfox botnet discovery execution infostealer stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

c8830b9e611ef52f5d4dcddee87c2ba1_JaffaCakes118.exe

Resource

win10v2004-20240802-en

diamondfox botnet discovery execution infostealer stealer

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  c8830b9e611ef52f5d4dcddee87c2ba1_JaffaCakes118
- Size
  
  231KB
- MD5
  
  c8830b9e611ef52f5d4dcddee87c2ba1
- SHA1
  
  fc7f516a1cc9916405e1f15f0be2432b356efe86
- SHA256
  
  0111dff6d3ba584e0293470dac4cdf629e61f842522ef2d4a3873ebf9dd703a8
- SHA512
  
  dca8de414cf9d841283184931d9977a299ad7ac47019330a464c10a69e2e9c98131c2e7cfdb658494c1f32975efde3f58128f2fcaad1046c8f495b6af8d845a9
- SSDEEP
  
  3072:JvOR1bc6l7Z/nJEpq/i8vJiEXQwd6yk0MD0feO4MuTrRn8XmLJhVsPH:V4DJX/zrrv4M3WLJAf
Score

10^/10

diamondfox botnet discovery execution infostealer stealer
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- DiamondFox payload
  Detects DiamondFox payload in file/memory.
  infostealer
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

diamondfoxbotnetdiscoveryexecutioninfostealerstealer

behavioral2

diamondfoxbotnetdiscoveryexecutioninfostealerstealer

© 2018-2024

Terms | Privacy