MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5774f205b3abcd5adc225b26b5ce546c2e7eb3490d03aa13c15234370dc42e27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DiamondFox
Vendor detections: 11
| SHA256 hash: | 5774f205b3abcd5adc225b26b5ce546c2e7eb3490d03aa13c15234370dc42e27 |
|---|---|
| SHA3-384 hash: | 4c18019ba58297412fed28158f6f5abce069adaca386fca581b5673c8bd1846e3615b92f29a7d8b81e54a47591c194ef |
| SHA1 hash: | 54cee91fd729023192df5c09366d9b29b244294c |
| MD5 hash: | ecc7c0d1e74e36914d07d8c94fe8212c |
| humanhash: | hawaii-saturn-butter-friend |
| File name: | ECC7C0D1E74E36914D07D8C94FE8212C.exe |
| Download: | download sample |
| Signature | DiamondFox |
| File size: | 2'223'936 bytes |
| First seen: | 2021-09-07 18:56:23 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c05041e01f84e1ccca9c4451f3b6a383 (142 x RedLineStealer, 109 x GuLoader, 64 x DiamondFox) |
| ssdeep | 49152:9gQlUhK+stgjsTuWbAuNC+2cPz7itu7NGrJMznKcYiH:yZVkjucAuNCyAJMdbH |
| Threatray | 529 similar samples on MalwareBazaar |
| TLSH | T111A533166BE296FED83A0D302AE57C410F76790A0D819A6F2B783724BD93F41DCCE251 |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | DiamondFox exe |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://178.23.190.242/ | https://threatfox.abuse.ch/ioc/216953/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ECC7C0D1E74E36914D07D8C94FE8212C.exe
Verdict:
No threats detected
Analysis date:
2021-09-07 18:58:34 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Searching for the window
Running batch commands
Connection attempt
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Launching a process
Creating a window
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Deleting a recently created file
Sending a UDP request
Creating a file in the Program Files subdirectories
Reading critical registry keys
Moving a file to the Program Files subdirectory
Replacing files
Sending an HTTP POST request
Creating a file in the %AppData% directory
Launching cmd.exe command interpreter
Modifying a system file
Possible injection to a system process
Unauthorized injection to a recently created process
Query of malicious DNS domain
Connection attempt to an infection source
Sending a TCP request to an infection source
Setting a single autorun event
Launching a tool to kill processes
Unauthorized injection to a system process
Enabling autorun by creating a file
Malware family:
Mokes
Verdict:
Malicious
Result
Threat name:
RedLine Vidar Xmrig
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates processes via WMI
Detected unpacking (changes PE section rights)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Performs DNS queries to domains with low reputation
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected RedLine Stealer
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Detection:
glupteba
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2021-09-03 23:38:41 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 519 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Score:
10/10
Tags:
family:redline family:vidar family:xmrig botnet:706 botnet:pub aspackv2 discovery evasion infostealer miner persistence spyware stealer
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: CmdExeWriteProcessMemorySpam
Script User-Agent
Modifies system certificate store
Modifies registry class
Modifies data under HKEY_USERS
Modifies Internet Explorer settings
Kills process with taskkill
Creates scheduled task(s)
Checks processor information in registry
Program crash
Enumerates physical storage devices
Drops file in Windows directory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Drops file in System32 directory
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Enumerates connected drives
Checks installed software on the system
Adds Run key to start application
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Drops file in Drivers directory
Downloads MZ/PE file
Blocklisted process makes network request
ASPack v2.12-2.42
XMRig Miner Payload
Vidar Stealer
Checks for common network interception software
xmrig
Vidar
Suspicious use of NtCreateProcessExOtherParentProcess
RedLine Payload
RedLine
Process spawned unexpected child process
Malware Config
C2 Extraction:
https://romkaxarit.tumblr.com/
193.56.146.78:51487
193.56.146.78:51487
Unpacked files
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
SH256 hash:
36d36bf735b2ab1079c6ca72d24f1491d47c122804046f1c7f86f544d09b01cc
MD5 hash:
71cf2841f2e39282e1051510082c4b35
SHA1 hash:
b67839763b177433c86ff9eaaa703c5607d3a843
Detections:
win_oski_g0
Parent samples :
baa381f572d293636b6e48cacd2cd6a6f4f9e5f71c583873260f6ac01f0f5e15
bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7
d0ed9b5279618e628f62a80cd1abdd208bdd3899cb6865b51591478ca03e46c6
5774f205b3abcd5adc225b26b5ce546c2e7eb3490d03aa13c15234370dc42e27
cd7445464e18fd8260e6a924e0795c9b09696eb2dbc7dd9f62794b6530ecca9d
bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7
d0ed9b5279618e628f62a80cd1abdd208bdd3899cb6865b51591478ca03e46c6
5774f205b3abcd5adc225b26b5ce546c2e7eb3490d03aa13c15234370dc42e27
cd7445464e18fd8260e6a924e0795c9b09696eb2dbc7dd9f62794b6530ecca9d
SH256 hash:
e198edcb4ef8222caaeaf8895ef247133b5a972960f7f77c5c2cefa4e5a07888
MD5 hash:
b07c598589308a5c5baf11bea2a0c78b
SHA1 hash:
00f3d36fe9abefd9fa011c21fd35840e2488c93d
SH256 hash:
606d3d9365f40fee12e9fc577ae5bf4cd42d502f4758320cdab01b53a7e0d4b8
MD5 hash:
51894ed4e7fec456b08027e2e6620386
SHA1 hash:
bbffdd90f9a5644086006734e03c15ac28db1ae9
SH256 hash:
062121d1ce2bc24b6fffa56da9ce44c54866ef995d9c31697db5a61ad90e6ad3
MD5 hash:
d22636263edab17dd68ff50f856a1ce0
SHA1 hash:
b693893b46eec9ba44812284ca3c8ef6b0111e3a
SH256 hash:
b9ae73b5bbafa9c4907ea6f783bd52bb1446b0d19ff26174b9453f467e4dbf70
MD5 hash:
87e9dd59201739365b2d3dd4a884aa35
SHA1 hash:
a05af00715244236db008731c1e7e1a515cfa776
SH256 hash:
d69b746ad21bba44c63458a99adef60ad2fff18027bd6dd6005b092064ea0825
MD5 hash:
2f58e087e1b174262b10dfeeb54c682c
SHA1 hash:
9b17d4ca6ffd9b1e3bc4213eee582c07074bcb92
SH256 hash:
71e8ed3b3df8fb1581ad3b309a9f2d543e26019fad260979ff3357bf0c5ca536
MD5 hash:
8a579cfba465a90b4083e58ff026ade7
SHA1 hash:
35e460c0f2cb1a8cc568217ce711f46613fe0a55
SH256 hash:
9dc77ea1abd72256c2cf906cf433610f48661779a1416b8546d4f9af09f26a5a
MD5 hash:
14d77d404de21055cfaa98fd20623c72
SHA1 hash:
0f32b94e597b1a42e0f5ba36fc8b25c1ee0ef21b
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
SH256 hash:
1512c8b7560ccc5b04f5ef5598256f04fcb5936ae0d5bf741fc063aa05396865
MD5 hash:
d88eb7b88955a5f0f55806f29f15d02c
SHA1 hash:
0da7c37dc1cbe8ceb5eea244354d419bd4a14158
SH256 hash:
c9bab89bf9158217c12570e71a98e4f9132bc16f787c22e6722c26c75c667df2
MD5 hash:
00be03baa5446870c26e3f67a2b3553b
SHA1 hash:
23016c591e1467e030aee076d5c577b8456b3c86
SH256 hash:
1321680791e400ebb02428458a07686ddb9b18fdf380bf966596b1f16967efd5
MD5 hash:
90321fc76f522792e84c8b6bc26cb834
SHA1 hash:
e1739e46481ff74b5f6b2a485bed56d2f333f40e
SH256 hash:
5774f205b3abcd5adc225b26b5ce546c2e7eb3490d03aa13c15234370dc42e27
MD5 hash:
ecc7c0d1e74e36914d07d8c94fe8212c
SHA1 hash:
54cee91fd729023192df5c09366d9b29b244294c
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.