MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4571cb6a42768d962b83472fd0e0069e56df5e005f15c1479f046bdf65dece1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DiamondFox


Vendor detections: 10


Intelligence 10 IOCs 4 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4571cb6a42768d962b83472fd0e0069e56df5e005f15c1479f046bdf65dece1a
SHA3-384 hash: 1603c6fa614d6b1792bb65afd05a228087334117bda503f5bcf3bfec8dd3879d3554d513724eb39a61ba4e9bc830cdbc
SHA1 hash: 4c7be150576f8411c94d145b153aaf33db8930e6
MD5 hash: 28723c8476963fb39f5cbb3f894db81c
humanhash: robert-item-bulldog-equal
File name:28723C8476963FB39F5CBB3F894DB81C.exe
Download: download sample
Signature DiamondFox
Create hunting rule
File size:3'485'692 bytes
First seen:2021-08-18 22:50:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 98304:yjgyUoRdfCLLHEGrHjikGE09vh6vJ7MZkuT:yj6oRAFrHjME09aJdk
Threatray 375 similar samples on MalwareBazaar
TLSH T185F53387EDA890D8FD5547BD1AD80DF16730C7A8005579AE33A0AF2CB0C35874A9BE5B
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:DiamondFox exe


Avatar
abuse_ch
DiamondFox C2:
http://185.53.46.33/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.53.46.33/ https://threatfox.abuse.ch/ioc/192020/
212.192.246.73:10854 https://threatfox.abuse.ch/ioc/192167/
149.28.252.135:26948 https://threatfox.abuse.ch/ioc/192169/
51.254.68.137:49913 https://threatfox.abuse.ch/ioc/192176/

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180476/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Searching for the window
Running batch commands
Connection attempt
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Deleting a recently created file
Launching a process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Bsymem
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/42df2479-5a1e-45ec-8f5d-4a1bb3183a43
Result
Threat name:
Cryptbot RedLine Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/835428
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to steal Chrome passwords or cookies
Creates HTML files with .exe extension (expired dropper behavior)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Disable Windows Defender real time protection (registry)
Drops PE files to the document folder of the user
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file has a writeable .text section
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Suspicious Svchost Process
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Cryptbot
Yara detected RedLine Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 467859 Sample: tZy4Bo2S4I.exe Startdate: 19/08/2021 Architecture: WINDOWS Score: 100 79 34.97.69.225 GOOGLEUS United States 2->79 81 192.168.2.4 unknown unknown 2->81 125 Multi AV Scanner detection for domain / URL 2->125 127 Antivirus detection for URL or domain 2->127 129 Antivirus detection for dropped file 2->129 131 15 other signatures 2->131 11 tZy4Bo2S4I.exe 10 2->11         started        signatures3 process4 file5 53 C:\Users\user\AppData\...\setup_installer.exe, PE32 11->53 dropped 14 setup_installer.exe 16 11->14         started        process6 file7 55 C:\Users\user\AppData\...\setup_install.exe, PE32 14->55 dropped 57 C:\Users\user\AppData\...\Mon06eba3e9aef.exe, PE32 14->57 dropped 59 C:\Users\user\AppData\...\Mon06c78fbc0c.exe, PE32 14->59 dropped 61 11 other files (4 malicious) 14->61 dropped 17 setup_install.exe 1 14->17         started        process8 dnsIp9 75 104.21.19.116 CLOUDFLARENETUS United States 17->75 77 127.0.0.1 unknown unknown 17->77 123 Adds a directory exclusion to Windows Defender 17->123 21 cmd.exe 17->21         started        23 cmd.exe 1 17->23         started        26 cmd.exe 17->26         started        28 7 other processes 17->28 signatures10 process11 signatures12 30 Mon0666585d5a1bb.exe 21->30         started        133 Obfuscated command line found 23->133 135 Uses ping.exe to sleep 23->135 137 Uses ping.exe to check the status of other devices and networks 23->137 139 Adds a directory exclusion to Windows Defender 23->139 35 powershell.exe 24 23->35         started        37 Mon06c78fbc0c.exe 26->37         started        39 Mon063543f483303eaf0.exe 1 14 28->39         started        41 Mon06b5caa1c73.exe 28->41         started        43 Mon063faea8f55ecb5.exe 2 28->43         started        45 2 other processes 28->45 process13 dnsIp14 83 185.233.185.134 YURTEH-ASUA Russian Federation 30->83 85 37.0.10.171 WKD-ASIE Netherlands 30->85 91 15 other IPs or domains 30->91 63 C:\Users\...\xyKennrY9nDMlgYKRMRGy4wi.exe, PE32 30->63 dropped 65 C:\Users\...\xr9ivO2SRW9Bmf8z2ZpeDXQ4.exe, PE32 30->65 dropped 67 C:\Users\...\ucfabQY6Vl7MDRlHEVSRQmTR.exe, PE32 30->67 dropped 73 55 other files (48 malicious) 30->73 dropped 99 Drops PE files to the document folder of the user 30->99 101 Creates HTML files with .exe extension (expired dropper behavior) 30->101 103 Tries to harvest and steal browser information (history, passwords, etc) 30->103 105 Disable Windows Defender real time protection (registry) 30->105 87 185.215.113.15 WHOLESALECONNECTIONSNL Portugal 37->87 89 104.26.12.31 CLOUDFLARENETUS United States 37->89 107 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 37->107 109 Tries to steal Crypto Currency Wallets 37->109 93 5 other IPs or domains 39->93 69 C:\Users\user\AppData\...\fastsystem.exe, PE32+ 39->69 dropped 71 C:\Users\user\AppData\...\aaa_011[1].dll, DOS 39->71 dropped 111 Contains functionality to steal Chrome passwords or cookies 39->111 113 Drops PE files to the startup folder 39->113 115 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 41->115 117 Checks if the current machine is a virtual machine (disk enumeration) 41->117 119 Creates processes via WMI 43->119 47 Mon063faea8f55ecb5.exe 43->47         started        95 2 other IPs or domains 45->95 121 Detected unpacking (changes PE section rights) 45->121 file15 signatures16 process17 dnsIp18 97 104.21.70.98 CLOUDFLARENETUS United States 47->97 51 C:\Users\user\AppData\Local\Temp\sqlite.dll, PE32 47->51 dropped file19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4571cb6a42768d962b83472fd0e0069e56df5e005f15c1479f046bdf65dece1a/
Threat name:
Win32.Trojan.Fabookie
Create hunting rule
Status:
Malicious
First seen:
2021-08-16 07:39:05 UTC
AV detection:
32 of 46 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ivy4w2sco2gzmk4di4x5byagtzln6xqal4k4cr47arv56zo6zyna._file
Verdict:
unknown
Similar samples:
12f7ffd93e0af380b2fe64c1477afcf876ae1449dcc197d71da381873bfbb439
DiamondFox
186992db0748857e13271f18b519fbf2b6f016bd8d81c3ee952786de798a6dad
DiamondFox
321ad36cf8f20be8c53d060b3043706a58ba49c4c25c994c96d19932137838cb
DiamondFox
423563995910af04cb2c4136bf50607fc26977dfa043a84433e8bd64b3315110
DiamondFox
5e1a4b9ced78b15872e2723b231e3934c4874c6ea28ebf6c983a61f5040b5f96
DiamondFox
c7bdff6b754ecaa682e2cb835114e9791e7fc8e8e90ce307c4432abbff800edd
DiamondFox
d72dd5663947fc7e1bd8903030b3e2fd551d8d938fdc6417d8513a1c4cc49702
DiamondFox
+ 365 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:vidar botnet:706 botnet:pab3 aspackv2 backdoor discovery evasion infostealer persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/210818-wft6xh6kls/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
Vidar Stealer
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Vidar
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
https://lenak513.tumblr.com/
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
185.215.113.15:61506
Unpacked files
SH256 hash:
6fe608e07ec1a73a9fa3e1457078afd907810f1faba32666786d141af3be0568
MD5 hash:
6e088927a17d87c498f7011b1e26fa3a
SHA1 hash:
7f58e9a788c520a7c299af00f97252ce3c4d7131
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
Parent samples :
365f984abe68ddd398d7b749fb0e69b0f29daf86f0e3e39af3573bb78a265eb9
ab948f038175411dc326a1aad83df48d6b656325015518b07535d22e3dae8bbb
96f34985e744edae462b513fd68856056c135078302d827eac076717acf8662e
3badebcefb9e7153384cae83baaa119f6317c9381e8500ac285568590e0abd82
734c31431b89b7501b984af35a2d61bdce27ba87ca484a64fb37ca5794e1a141
162ab00c0e943f9548b04f3437867508656480585369cb705613dd3accfd54c2
SH256 hash:
1ab460eac81001bfa0da8cbadfd4fba0ad0f371742a2c725ff5cf71bdd8e2b9f
MD5 hash:
1dc95107f7dd6d1392bb8d9b53b76916
SHA1 hash:
b26f9c90ad4656d2ddf3e96da967e0f65a9623e1
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
d1ff2f8a510fb4d25dd861e4cd5196585ccdd66cd6e941941e13d634da825f32
MD5 hash:
e3ed5e6a62ece3cf158688bce4161fbf
SHA1 hash:
5a8c4dddf69e8650952b0d29987cc6edfe25fb0b
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
ab9bb888f6235eaee1ad52cd9b4d1f960ea09743ff80919d0095383f3683c583
MD5 hash:
eff546ee925781db419befdf93bd045d
SHA1 hash:
1129b509403fa589b50310f99f77c69ecc7f8314
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
67f15ef8791238c0520d74240f69f5cb13adf0ff34d32fab4942d9ef17c38789
MD5 hash:
a13744be8e3927ec25fcc06c8b33bca2
SHA1 hash:
7e71f8ca93cf7872603d0e73d36c9931cac5239c
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
a19adea0a2b66cfcb23eebd1d1ff9d854eccd4dc65536a45665c149da4ff6265
MD5 hash:
117c7ff5dd9efc0b059f64520f2d4f46
SHA1 hash:
ff07b1fcc58aa62b42d797981e0d953d9f9e0120
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
0d724917351ac3df889861d6d7be87cef703ff1eb9a4c8c34abb19fbd235a3e7
MD5 hash:
5a04a5ca3a23713d8849357f6e639782
SHA1 hash:
e548704029e05b29c6c5b366d0a9add0208009b7
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
10145b37f78b11928fd9f8d90e3cdf0aaa7b705649e249869443581f9d7a59db
MD5 hash:
a2429e9231e520ea76c47e629481826a
SHA1 hash:
b34b9372ead90cb559e7ac5b97cc569fe1a7cd3a
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
80977bcc232601987d378e1036c07035a1bfe70803072bf497e1a0aead085905
MD5 hash:
bfdd6dc1d021d885606249743f63c43a
SHA1 hash:
a6468c1356edf1a28bdc90f0d7aa30188fc01d48
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
615728c4c56b02e41e7c80c08bce3f1370ffea3a206a2ed522fbe1c6866c45b5
MD5 hash:
1a6a1b11ed23572d02a61fa11d3c97cb
SHA1 hash:
36cc105146399aaed38d63c273a96478c9dc1183
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
127d7cd49cc80715f6e515014a635bf2b4d5b814f4a4fb8fd0fd754764287a53
MD5 hash:
6211cad505a0b3e87a14ecafd3cee7ee
SHA1 hash:
72a7ea3b4bd748fc9c3733164270eda1133279f7
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
e7fe30767e6e139d54ca1c53489b4f8e4f2a37457e0b89beafb5496e49719a01
MD5 hash:
e98da8dc11499d12a8f9fa349d65396b
SHA1 hash:
6b5c0b77b4080646527e011df6e74277b6a2f975
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
d2591d4d99badef32757e4b1976a9db25db123c51aff705f8b7080a6f608fc9f
MD5 hash:
835fb51dc9fcbc24ed962a8e24c36a6f
SHA1 hash:
734b7144b77fd1d6923eafdde5c440859c9bcd50
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
a85913d90d7a96a33ca1b07c60fe2bb61e9856f0fdffba76797fab65a5d7f0ee
MD5 hash:
ec966ebf735289e42f8c6e4d67d89418
SHA1 hash:
0d7b46e084137d7f02854164145a16e298fb9720
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
f6d3b76e393d917704f2ce697ca4198f9511efff41692d95b44e6c1bc84f64e6
MD5 hash:
12e504426e0df6d0b2808a2162d4ce35
SHA1 hash:
6ef588bcea8d3432034f45c06723ae64f33b782f
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
SH256 hash:
4571cb6a42768d962b83472fd0e0069e56df5e005f15c1479f046bdf65dece1a
MD5 hash:
28723c8476963fb39f5cbb3f894db81c
SHA1 hash:
4c7be150576f8411c94d145b153aaf33db8930e6
Link:
https://www.unpac.me/results/6652b510-c96a-440c-879b-d7fcdd36d0f1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4571cb6a42768d962b83472fd0e0069e56df5e005f15c1479f046bdf65dece1a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:RedOctoberPluginCollectInfo
Create hunting rule
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/180476/

Comments