Overview

overview

10

Static

static

1

na.elf

ubuntu-22.04-amd64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    na.elf
  • Size 74.1MB
  • Sample241007-fxqtfa1hnb
  • SHA256 29e7e3f486f428916cf43dca588070a64a6059fcabeb7be30431dfdf42592b13
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
diamondfoxantivmbotnetdiscoveryevasionlinuxstealer

Malware Config

Targets

    • Target
      na.elf
    • Size 74.1MB
    • SHA256 29e7e3f486f428916cf43dca588070a64a6059fcabeb7be30431dfdf42592b13
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    diamondfoxantivmbotnetdiscoveryevasionstealer

    • DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox

    • DiamondFox stealer

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Reads MAC address of network interface

      Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

      evasiondiscovery

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks