Diomond Fox

Diomond Fox

Ceramic Coating and Paint Correction

Elite Level Protection.
Done Right.
The First Time.

"Because your ride deserves to shine"

Hand-Wash with microfiber mitts (two bucket method)

3 Month Silica Sealant (Glass, Tires and Exterior Paint)

Two Front Seats get Leather Conditioned

Full Paint Decontamination Treatment

Gloss Enhancement Polish & 3-Year Coating Package

Full Paint Decontamination Treatment

$150 if combined with a standard detail

*does not remove scratches / swirls

After you request a quote, this is exactly what will happen:

Later that day (or the next business day) I (Jesse) will call you. During this 10 to 15 minutes conversation we’ll cover The current condition of your car. Your ideal goals for this service. How long this will take (usually around 5.5 – 6 hours, depending on your car’s condition). and we’ll schedule a date and time for you to drop your car off.

Working with Jess has been nothing short of exceptional. The quality of his work is obviously top notch. The customer service provided is one of a few that provides “the good old days” level of care.

There’s no reason to take your car to a large detail shop. Do yourself a favor and take it to an expert dedicated enough in the art to create a business for it.

I’ll be bringing my car exclusively to him from here on out. Bravo 👏🏼👏🏼👏🏼

*repeat customer* I've used multiple car detailing services throughout the greater Seattle area and this is the only I've come back to. I would trust Jess with any vehicle; he treats your car like his own. His passion and dedication to his business and the industry are visible in all his work. Highly recommend this business!

If you want the best, Mr. Fox is your man! I've had him do ceramic coating on my truck & both motorcycles and they all came out amazing. He has been the ONLY detailer I've been using the past several years now and I refer everyone I can to him. He shows up & takes pride in what he does, both something many detailers seem to struggle with. Most detailers make it look "good enough" then on to the next customer. My stuff ALWAYS looks on point with a Diamond Fox detail, and he doesn't leave until HE is satisfied it looks as good as it possibly can!

Elite Level Automotive Detailing & Coatings

21+ years of luxury Vehicle Experience

Getting Your Car to Showroom-Level Shine

From the initial request for a quote to the initial inspection and then final walk-through of the finished job, he was nothing short of professional and informative. He even kindly sent me an in-progress photo of my car as he was working on it and followed up with me to confirm I still wanted the add-on I had requested.

You Deserve to Protect Your Investment

Elite-Level Service. Done Right. The First Time.
NOTICE: Currently booked until June 29th 2022
Click Here to Apply For the Waitlist

West Seattle, WA 98126
By Appointment Only

Call or Text to reach me directly
Call before arriving
Protect your car from getting weathered and extend your paint’s longevity. Keep your car looking new with our SB3 Alpha Ceramic Coating Services.

"No surprises. Just quality elite-level services. Done right. The first time."

~Jesse Fox
I’ve spent two decades of my career in the detailing business. Dialing in my experience around protecting, coating, and detailing luxury vehicles. I’m a low-volume, high-quality focused shop.
I’m a craftsman devoting my efforts to create a pleasant experience for my clients.

The most durable supplies are what my clients are looking for. The products and coating lines are some of the best formulas used in the industry. They're tried-and-true professional-grade materials that give a long-lasting gloss and a durable coat.

With over 21 years of auto detailing experience, you can trust that you're in good hands. My background ranges from body shops, to dealerships and high-end clubs where I've mastered my techniques. In all honesty, automotive detailing is a lifestyle for me which falls in-line with my other passions as an artist.

My skills set me apart from many others, and I still prefer to use an old-school rotary polisher when doing my elite-level services. I feel that people can get caught up in the latest and greatest technology while losing track of certain fundamentals.

Fill out the “Get a Quote” form and I’ll get back to you within 24 hours.
When I give you a call, we’ll discuss your vehicle’s conditions and goals for this service.
Then we’ll schedule a time for you to bring your vehicle in to my shop.
Finally, when you drop your vehicle off, I’ll give you a call when it’s ready for pickup. This can be from 4 hours to overnight for a more involved service.
Due to the amount of inquiry regarding pricing we decided to post a blog. There are different variables as far as this service goes. The
Have you ever been out on a blind date to find out that the person you thought you were meeting, wasn’t such at all? Welcome
Don’t be fooled by the headline in this blog. We are not referring to low-end ceramic coatings which many company’s tend to throw the term

West Seattle, WA 98126
By Appointment Only

Call or Text to reach me direclty
Call before arriving
© All rights reserved, Diamond Fox Auto Detailing LLC 2022

Something went wrong, but don’t fret — let’s give it another shot.

Security & Antivirus
Malwarebytes for Windows
Malwarebytes for Mac
Malwarebytes for Chromebook
Malwarebytes Browser Guard
Overview

Security & Antivirus for Mobile
Malwarebytes for Android
Malwarebytes for iOS

Online Privacy
Malwarebytes Privacy VPN

Find the right solution for your business
See business pricing

Don't know where to start?
Help me choose a product

See what Malwarebytes can do for you
Get a free trial

Our team is ready to help. Call us now
+1-800-520-2796

Managing Director at Optimus Systems

Learn About Cybersecurity
Antivirus
Malware
Ransomware
See all

Malwarebytes Labs
Explore

Business Resources
Reviews
Analyst Reports
Case Studies
See all

Press & News
Learn more

Training for Personal Products

Training for Business Products

Company

About Malwarebytes
Careers
News & Press

Sign In

My Account

Cloud Console

Partner Portal

In this short series of posts, we will take a deep dive in a sample of Diamond Fox delivered by the Nebula Exploit Kit (described here). We will also make a brief comparison with the old, leaked version, in order to show the evolution of this product.

3979 Freedom Circle, 12th Floor Santa Clara, CA 95054

One Albert Quay, 2nd Floor Cork T12 X8N6 Ireland

Protect your devices, your data, and your privacy—at home or on the go.
"Thanks to the Malwarebytes MSP program, we have this high-quality product in our stack. It’s a great addition, and I have confidence that customers’ systems are protected."
Activate Malwarebytes Privacy on Windows device.
New business customers save 15% on powerful, easy-to-use EDR – See Offer >
Check out our MITRE ATT&CK Top performance! View Results >
Posted: March 17, 2017 by Malwarebytes Labs

Last updated: March 28, 2017

Diamond Fox (also known as Gorynch) is a stealer written in Visual Basic that has been present on the black market for several years. Some time ago, builders of its older versions (i.e. 4.2.0.650) were cracked and leaked online – thanks to this we could have a closer view at the full package that is being sold by the authors to other criminals.
In 2016 the malware was almost completely rewritten – its recent version, called “Crystal” was described some months ago by Dr. Peter Stephenson from SC Media ( read more ).
In this short series of posts, we will take a deep dive in a sample of Diamond Fox delivered by the Nebula Exploit Kit (described here ). We will also make a brief comparison with the old, leaked version, in order to show the evolution of this product.
In this first part, we will take a look at Diamond Fox’s behavior in the system, but the main focus will be about unpacking the sample and turning it into a form that can be decompiled by a Visual Basic Decompiler .
After being deployed, Diamond Fox runs silently, however, we can notice some symptoms of its presence in the system. First of all, the UAC (User Account Control) gets disabled and we can see an alert about it:
Another pop-up is asking the user to restart the system so that this change will take effect:
The initial executable is deleted and the malware re-runs itself from the copy installed in the %TEMP% folder. It drops two copies of itself – dwn.exe and spoolsv.exe . Viewing the process activity under Process Explorer, we can observe the spawned processes:
For persistence, Diamond Fox creates a new folder with a special name ( read more about this feature ): %TEMP%\lpt8.{20D04FE0-3AEA-1069-A2D8-08002B30309D} .
Thanks to this trick, the user cannot access the files dropped inside. Another copy (backup) is dropped in the Startup folder.
While running, the malware creates some files with .c extensions in %APPDATA% folder:
Also, new files are created in the folder from which the sample was run:
The file keys.c contains an HTML formatted log about the captured user activities, i.e. keystrokes. Here’s an example of the report content (displayed as HTML):
The files log.c and Off.c are unreadable.
Examining the content of the %TEMP% folder we can also find that the malware dropped downloaded payload inside:
It is a XOR encrypted PE file (key in the analyzed case is: 0x2), that turns out to be an update of the main Diamond Fox bot.
Diamond Fox communicates with the CnC using an HTTP-based protocol. It beacons to gate.php
Data from the bot is sent to the CnC in form of a POST request. Pattern:
Responses from the CnC have the following pattern:
We can observe the bot downloading in chunks some encrypted content (probably the payload/bot update):

It also periodically uploads the stolen data. In the example below: sending the report about the logged user activities (content of the previously mentioned file keys.c ):
Diamond Fox is distributed packed by various crypters, that require different approaches for unpacking. They are not specifically linked with this particular family of malware, that’s why this part is not going to be described here. However, if you are interested in seeing the complete process of unpacking the analyzed sample you can follow the video: https://www.youtube.com/watch?v=OBAVHiX-j_A .
After defeating the first layer of protection, we can see a new PE file. It is wrapped in another protective stub – this time typical for this version of Diamond Fox. The executable has three unnamed sections followed by a section named L!NK . The entry point of the program is atypical – set at the point 0.
It makes loading the application under common debuggers a bit problematic. However, under a disassembler (i.e. PE-bear) we can see, where this Entry Point really leads to:
The header of the application is interpreted as code and executed. Following the jump leads to the real Entry Point, that is in the second section of the executable:
I changed the the executable Entry Point and set it to the jump target (RVA 0xEDB0).
Saved application could be loaded in typical debuggers (i.e. OllyDbg) without any issues, to follow next part of unpacking.
The steps to perform at this level are just like in the case of manual unpacking of UPX. The execution of the packer stub starts by pushing all registers on the stack (instruction PUSHAD). We need to find the point of execution where the registers are restored, because it is usually done when the unpacking of the core finished. For the purpose of finding it, after the PUSHAD instruction is executed, we follow the address of the stack (pointed by ESP). We set a hardware breakpoint on the access to the first DWORD.
We resume the execution. The application will stop on the hardware breakpoint just after the POPAD was executed restoring the previous state of the registers.
This block of code ends with a jump to the unpacked content. We need to follow it in order to see the real core of the application and be able to dump it. Following the jump leads to the Entry Point typical for Visual Basic applications. It is a good symptom because we know that the core of Diamond Fox is a Visual Basic application.
Now we can copy the address of the real Entry Point (in the analyzed case it is 0x4012D4) and dump the unpacked executable for further analysis.
I will use Scylla Dumper. Not closing OllyDbg, I attached Scylla to the running process of Diamond Fox (named s_1.exe in my case).
I set as the OEP (Original Entry Point) the found one, then I clicked IAT Autosearch and Get Imports :
Scylla found several imports in the unpacked executable:
We can view the eventual invalid and suspected imports and remove them – however, in this case, it is not required. We can just dump the executable by pressing button Dump .
Then, it is very important to recover the found import table by clicking Fix Dump and pointing to the dumped file. As a result, we should get an executable named by Scylla in the following pattern: _dump_SCY.exe.
Now, we got the unpacked file that we can load under the debugger again. But, most importantly, we can decompile it by a Visual Basic Decompiler to see all the insights of the code.
Example of the decompiled code – part responsible for communication with the CnC (click to enlarge):
Unpacking Diamond Fox is not difficult, provided we know a few tricks that are typical for this malware family. Fortunately, the resulting code is no further obfuscated. The authors left some open strings that make functionality of particular blocks of code easy to guess. In the next post, we will have a walk through the decompiled code and see the features provided by the latest version of Diamond Fox.
This was a guest post written by Hasherezade, an independent researcher and programmer with a strong interest in InfoSec. She loves going in details about malware and sharing threat information with the community. Check her out on Twitter @ hasherezade and her personal blog: https://hshrzd.wordpress.com .
You must be logged in to post a comment. Click here to login or connect a social media account to leave a comment.
April 10, 2017 - A compilation of notable security news and blog posts from the 3rd of April to the 9th. We focused on the 3-2-1 rule, further dissected Diamond Fox, and revealed a malvertising campaign targeting iOS users.
April 6, 2017 - In a previous post we made an initial analysis of a Diamond Fox bot delivered by the Nebula Exploit Kit (more about the campaign can be found here). We described the way to unpack the protection layer in order to get the core, written in Visual Basic, that can be decompiled. In this second part of...
Want to stay informed on the latest news in cybersecurity? Sign up for our newsletter and
learn
how to protect your computer from threats.
Imagine a world without malware. We do.
©
2022 All Rights Reserved
Your intro to everything relating to cyberthreats, and how to stop them.

You must be logged in to post a comment.

Ebony Girl Feet
Reality Kings Moms At It Again
Carlos Gutiérrez

Diomond Fox

Report Page