diamondfox

General

Target

SearchIndexer.exe
Size

91KB
Sample

240928-s3jzastaqr
MD5

1cc07a0274718e845c9b77f8334c4cb3
SHA1

12b6c08371fd4661ed2da442e7ec34f226d7ac01
SHA256

b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
SHA512

0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d
SSDEEP

768:p4drUhaNJp/Z4+UbvK76rVtMumnS8pFLkFDNL5HkKTog4ZI7O9RYdi7aehyf0CFz:p4Yh+5RivTopgd2X9BLLoGoVfj6zyfi

Score

10^/10

Malware Config

Extracted

Family

diamondfox

C2

http://timesync.live/panel/gate.php

http://cartierxs.bit/panel/gate.php

http://salamsa.bit/panel/gate.php

http://rockababy.bit/panel/gate.php

http://minon.bit/panel/gate.php

http://bloxfox.bit/panel/gate.php

http://ggbbee.bit/panel/gate.php

http://locksock.bit/panel/gate.php

http://misosoup.bit/panel/gate.php

http://opseckes.bit/panel/gate.php

http://googletabmanager.com/panel/gate.php

Mutex

cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS

xor.plain

Targets

- Target
  
  SearchIndexer.exe
- Size
  
  91KB
- MD5
  
  1cc07a0274718e845c9b77f8334c4cb3
- SHA1
  
  12b6c08371fd4661ed2da442e7ec34f226d7ac01
- SHA256
  
  b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
- SHA512
  
  0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d
- SSDEEP
  
  768:p4drUhaNJp/Z4+UbvK76rVtMumnS8pFLkFDNL5HkKTog4ZI7O9RYdi7aehyf0CFz:p4Yh+5RivTopgd2X9BLLoGoVfj6zyfi
Score

10^/10

diamondfox botnet discovery execution infostealer stealer
- DiamondFox
  DiamondFox is a multipurpose botnet with many capabilities.
  botnet stealer diamondfox
- DiamondFox payload
  Detects DiamondFox payload in file/memory.
  infostealer
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

DiamondFox payload

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2