MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d1d2cd3f3cbce923d3db88aa44212210da57e9e032e2ff4a1766fe51ff1255e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DiamondFox


Vendor detections: 12


Intelligence 12 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d1d2cd3f3cbce923d3db88aa44212210da57e9e032e2ff4a1766fe51ff1255e
SHA3-384 hash: ad379bca2e150b762f25761c3975974cab0a093620d2a993b0a0e6b85e996a3c58865af7192e7dbda4ddfbe1b2908ad3
SHA1 hash: 94db08baa878322eec7359ebf0f43feb9ac9c97e
MD5 hash: 4554bf0ab199af75af2199e9bde53a33
humanhash: papa-uniform-sad-six
File name:4554BF0AB199AF75AF2199E9BDE53A33.exe
Download: download sample
Signature DiamondFox
Create hunting rule
File size:4'396'304 bytes
First seen:2021-07-12 14:35:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 98304:UbGw1zt5RyFximddVbj6Yhosvk3upL/pUWt7kyZ9N:UywVixHddhu4osvkuLG8jN
Threatray 98 similar samples on MalwareBazaar
TLSH T17C163341BCE494F1D4262D754A747F119C3DBD204B24CAAF93F8196E9236282AF32F67
Reporter abuse_ch
Tags:DiamondFox exe


Avatar
abuse_ch
DiamondFox C2:
45.140.147.193:35789

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.140.147.193:35789 https://threatfox.abuse.ch/ioc/159762/
185.153.198.53:57843 https://threatfox.abuse.ch/ioc/159777/

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4554BF0AB199AF75AF2199E9BDE53A33.exe
Verdict:
Malicious activity
Analysis date:
2021-07-12 14:40:06 UTC
Tags:
evasion autoit trojan stealer vidar loader
Link:
https://app.any.run/tasks/72914e44-e5f0-48b9-b507-33128961d5a4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CookieStealer
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171144/
Detection(s):
Win.Malware.Generic-9866235-0
Create hunting rule

Win.Malware.Nymeria-9873414-0
Create hunting rule

Win.Malware.SmokeLoader-9874090-1
Create hunting rule

Win.Malware.Generic-9874384-0
Create hunting rule

Win.Malware.Qshell-9875653-0
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Socelars
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/11c90309-aae2-4d2c-9519-6e43cedca157
Result
Threat name:
Backstage Stealer Raccoon RedLine SmokeL
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/814958
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Checks if the current machine is a virtual machine (disk enumeration)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
DLL reload attack detected
Drops PE files to the document folder of the user
Drops PE files to the user root directory
Found C&C like URL pattern
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Performs DNS queries to domains with low reputation
Renames NTDLL to bypass HIPS
Sample is protected by VMProtect
Sigma detected: Execution from Suspicious Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Backstage Stealer
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Socelars
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 447367 Sample: pCCZmmulmJ.exe Startdate: 12/07/2021 Architecture: WINDOWS Score: 100 93 google.vrthcobj.com 2->93 95 ip-api.com 208.95.112.1, 49782, 80 TUT-ASUS United States 2->95 97 7 other IPs or domains 2->97 123 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->123 125 Multi AV Scanner detection for domain / URL 2->125 127 Antivirus detection for URL or domain 2->127 129 18 other signatures 2->129 9 pCCZmmulmJ.exe 1 15 2->9         started        12 iexplore.exe 1 58 2->12         started        14 svchost.exe 1 2->14         started        signatures3 process4 file5 61 C:\Users\user\Desktop\pub2.exe, PE32 9->61 dropped 63 C:\Users\user\Desktop\jg3_3uag.exe, PE32 9->63 dropped 65 C:\Users\user\Desktop\Installation.exe, PE32 9->65 dropped 67 6 other files (3 malicious) 9->67 dropped 16 Info.exe 9->16         started        21 Files.exe 10 9->21         started        23 pub2.exe 9->23         started        27 5 other processes 9->27 25 iexplore.exe 38 12->25         started        process6 dnsIp7 79 www.jinhuamz.com 103.155.92.207, 49762, 80 TWIDC-AS-APTWIDCLimitedHK unknown 16->79 81 79.174.12.174, 49753, 80 THEFIRST-ASRU Russian Federation 16->81 87 14 other IPs or domains 16->87 43 C:\Users\...\ws8BnHKOR30swQBWKETe55xU.exe, PE32 16->43 dropped 45 C:\Users\...\wDE4NsEZp01rhTC_jAdkRZ9g.exe, PE32 16->45 dropped 47 C:\Users\...\vlWarIjWPAACc18g0IsDuvJn.exe, PE32 16->47 dropped 57 37 other files (28 malicious) 16->57 dropped 103 Drops PE files to the document folder of the user 16->103 105 Performs DNS queries to domains with low reputation 16->105 107 Disable Windows Defender real time protection (registry) 16->107 49 C:\Users\user\AppData\Local\Temp\...\File.exe, PE32 21->49 dropped 29 File.exe 3 20 21->29         started        51 C:\Users\user\AppData\Local\Temp\CC4F.tmp, PE32 23->51 dropped 109 DLL reload attack detected 23->109 111 Renames NTDLL to bypass HIPS 23->111 113 Checks if the current machine is a virtual machine (disk enumeration) 23->113 89 2 other IPs or domains 25->89 83 g-partners.live 176.113.115.136, 49750, 80 SELECTELRU Russian Federation 27->83 85 101.36.107.74, 49745, 80 UHGL-AS-APUCloudHKHoldingsGroupLimitedHK China 27->85 91 4 other IPs or domains 27->91 53 C:\Users\user\Documents\...\jg3_3uag.exe, PE32 27->53 dropped 55 C:\Users\user\AppData\Roaming\6619683.exe, PE32 27->55 dropped 59 2 other files (none is malicious) 27->59 dropped 115 Detected unpacking (changes PE section rights) 27->115 117 Detected unpacking (overwrites its own PE header) 27->117 119 Tries to harvest and steal browser information (history, passwords, etc) 27->119 121 Creates processes via WMI 27->121 34 Folder.exe 27->34         started        36 conhost.exe 27->36         started        file8 signatures9 process10 dnsIp11 99 newja.webtm.ru 92.53.96.150, 49740, 80 TIMEWEB-ASRU Russian Federation 29->99 101 192.168.2.1 unknown unknown 29->101 69 C:\Users\Public\run2.exe, PE32 29->69 dropped 71 C:\Users\Public\run.exe, PE32 29->71 dropped 133 Binary is likely a compiled AutoIt script file 29->133 135 Drops PE files to the user root directory 29->135 38 run.exe 29->38         started        73 C:\Users\user\AppData\Local\Temp\axhub.dll, PE32 34->73 dropped 75 C:\...\api-ms-win-core-string-l1-1-0.dll, PE32 34->75 dropped 77 C:\...\api-ms-win-core-namedpipe-l1-1-0.dll, PE32 34->77 dropped 41 conhost.exe 34->41         started        file12 signatures13 process14 signatures15 131 Multi AV Scanner detection for dropped file 38->131
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d1d2cd3f3cbce923d3db88aa44212210da57e9e032e2ff4a1766fe51ff1255e/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2021-07-08 20:39:47 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fuoszu7tzphjepj5xcfkiqqseeg2k7u6amxc75fbozx6kh7revpa._file
Verdict:
malicious
Similar samples:
00ac3efa4faaa3927d28bf7b78793d4dac0c814cdbefb2015734d76bee8c988f
DiamondFox
16bf40060a0544cf49bda85272b976265fb56248c6068d7d95296937af664ecc
DiamondFox
1a1d8823b35b8c0d8dfcebe065520a07fe105589893262976fce4122317c55b8
DiamondFox
20ed0f1b402d630a3e131e9e788c57a74d348bcc358e1c0e6f5fd112ad838ab3
DiamondFox
46836190326258f65c9dbc1930b01e9d3de04996a1a2c79e39a36c281d79fe0a
DiamondFox
76b87f4f61c849a8af46ebdcb899a0bea036b18f6b473bed34562212eab16b93
DiamondFox
923e1d37bb37118bd66462b153d9fa0d4518898ed56f0252690a6d9eb111a0d7
DiamondFox
adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440
DiamondFox
bf86597d2d10ad8d82f0af8b53cf72757094322e79e92180092aa60341b90034
DiamondFox
+ 88 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:metasploit family:redline family:smokeloader family:socelars family:vidar botnet:865 botnet:890 botnet:903 botnet:921 backdoor discovery dropper evasion infostealer loader persistence spyware stealer themida trojan upx vmprotect
Link:
https://tria.ge/reports/210712-33ajz63w8a/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
autoit_exe
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Sets DLL path for service in the registry
Sets service image path in registry
UPX packed file
VMProtect packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
Glupteba
Glupteba Payload
MetaSploit
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
Suspicious use of NtCreateProcessExOtherParentProcess
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Windows security bypass
Malware Config
C2 Extraction:
https://sergeevih43.tumblr.com/
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Unpacked files
SH256 hash:
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498
MD5 hash:
cc0d6b6813f92dbf5be3ecacf44d662a
SHA1 hash:
b968c57a14ddada4128356f6e39fb66c6d864d3f
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
55361941ab12c7edd987c706d25423d868f756fab1028d99eeffacdabf3da4ca
MD5 hash:
4de4b7bc0a92902422c4204fcfa58150
SHA1 hash:
587e0299ea32cc836281998941daa60f471e3480
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
MD5 hash:
7165e9d7456520d1f1644aa26da7c423
SHA1 hash:
177f9116229a021e24f80c4059999c4c52f9e830
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
8d063d3aef4de69722e7dd08b9bda5fdf20da6d80a157d3f07fa0c3d5407e49d
MD5 hash:
559948db5816ae7ab26eb2eb533887ed
SHA1 hash:
e60442c6fb35239d298b01b0f4558264c01b2e7f
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
MD5 hash:
1c7be730bdc4833afb7117d48c3fd513
SHA1 hash:
dc7e38cfe2ae4a117922306aead5a7544af646b8
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
4d4ad145431ee356221914f2908ff9b4a4a56f90b9409ec752f7be1a978e7435
MD5 hash:
ae7c477ce9bd98d13ccff5fc4a0d190e
SHA1 hash:
249ff902f66c3d0cee6656802b14a9c34807bc8f
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
371c66befe4b79a2c7d36510a6ca9c134a57b84c283144ab25e6c39f6dc1d1a1
MD5 hash:
8074ffe3641069db4167874dd7be05df
SHA1 hash:
5e2554a7f057f3f519abbcc61ecefc40081a848a
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
8ed076ba0481e9cdb34820e0850b23a971470df9f9214442d6bd47889ce1a60e
MD5 hash:
32beb2727233be047ebfa9f98e3a092d
SHA1 hash:
31d750e99b5ce9b6bfd5e0ee9d71e64188a90f4f
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
1a33f2645a6e1add5256dc036bf0c18f4c95043faa714b6bbfc3dd8cccbb62ac
MD5 hash:
ffdd1ee035afeff8c371ea46bd893d89
SHA1 hash:
002d446b38a6683929bf3cf95f532a41e870d1bf
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
c2dba54c40d00efac2da98efe93aa053cc112651a894c6f7ebf9ae9797fe274f
MD5 hash:
fa7ff34449f91904aa753e094f86bd6c
SHA1 hash:
79e2022b06889068da05f731b2c2265cedb78afc
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
c83c2160c4581be6d31fd9ff5615d26b896f26741243a011c161ff38c2a8e241
MD5 hash:
89975f7ee6f2522ace9846135e80d7a8
SHA1 hash:
37fd8b03e052ac7d4fefade47719f6d407633606
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
67cdc7c5de5e46229adc831dc6fd3053d996ecf02e94706b6b6ae1b0ed976f2c
MD5 hash:
555b5b60b2dcc53e71e6d9ba8302c4b9
SHA1 hash:
550326b1226629a867d4606ad0c98c4ef9596b47
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
Parent samples :
e47bfa7b58706edeeaf73664039c10cb1ff7a517d833c0b28751b835bdc68cf7
32ac0624a534a2c40fb8eba41e80bb1d31b99cd118d42208c89229079699f783
SH256 hash:
720d9d0b5ee7991a664f1379d32193970fa820eb39e66ad4d76a5105969bfb57
MD5 hash:
8f7c23a7a0d1a238989264a2033eb7ff
SHA1 hash:
c60042c846c276db164b58fe1391c8cbdbcb82e5
Detections:
win_socelars_auto
Create hunting rule
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
f3eef4d267e51d143bb101afc81772fc5f8369db422c9a4fdab034c6b61a6c54
MD5 hash:
7037090fdd80fc8502db986d8c89f80d
SHA1 hash:
1862c60afc72139fb2013d48bd010b2f6fb4a1d5
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
4a7b1aaec3b66c078805a42264784fd9cb728aca9a393664a3d42fdfe1785323
MD5 hash:
8a653b33fb0ad8f5cd89f254954de444
SHA1 hash:
1caff7be41de93f6c73f189295e24dfbfabe8ec8
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
8cb4f2e56e22a2deda815e8f0151a13e41ec5e5baf861591f15c61c597d2312d
MD5 hash:
d77b2ba69cf197924cd2b7d55a057a3d
SHA1 hash:
a90ca116b1da7f25ec5c09526a9504c8ccd7b9d4
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
e02c03dd45a6dff63c6d9cef0c623a7da4551281fdff0c9376ba457c219e299d
MD5 hash:
0d2803e0a0dcb977d32bd0eb0bc6520a
SHA1 hash:
35f615b09a3dd82763db6756859226945d86f3c2
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
da9dec4d608584d28f4b7e06223e3f85269b86ea18149546c922062b109bbb4c
MD5 hash:
e864e470061ff4dbb71c49d6eeb2439c
SHA1 hash:
7fadeef4e04c4983e526fbab82ed3091ab77631a
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
ce1de6d1c6044ea6ee862863861f643c71c75550042246809a4cfe7f91699ebf
MD5 hash:
a3589b597d9681431ddafa743698b2e8
SHA1 hash:
14be5daa58fd621945e716548830d97e7e1d7449
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
SH256 hash:
2d1d2cd3f3cbce923d3db88aa44212210da57e9e032e2ff4a1766fe51ff1255e
MD5 hash:
4554bf0ab199af75af2199e9bde53a33
SHA1 hash:
94db08baa878322eec7359ebf0f43feb9ac9c97e
Link:
https://www.unpac.me/results/fc7717c5-e94a-445e-92ed-a1e40303e76f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d1d2cd3f3cbce923d3db88aa44212210da57e9e032e2ff4a1766fe51ff1255e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/171144/

Comments