onyxc2 | 5d48e83132f69c6ded86e7ced5a6b80b87d79ddefcc909105d2f84e89a9f9b5c

General

Target
Fling-Standalone25.264.54874.zip
Size 41.2MB
Sample260625-n1sffabt2y
SHA256 5d48e83132f69c6ded86e7ced5a6b80b87d79ddefcc909105d2f84e89a9f9b5c
MD5 301a6526bbb4f0c86fc0b668c2776847
SHA1 0716fcf701e22d281b3ceedd300a88ce70d336b6
SHA512 88d035ed937fa274c87d771838280a979995267aeae31a064226bcb99e2ab78b47bc99d3e51418a51ec1d337961a231a234a727561b3e9243127746a1225d900
SSDEEP 786432:lDMbE/FP51gmE14FApxeYOKMPEOvJBBer/v8OZDANqKye3D2HAVy1bC+utQtUkZu:l8op5DEnpxoBJBwr/0OZo1y2y1W+u2U5
TLSH
T18F973305C8E5925F2C92FFA1C55C41AE7EF64032932A36C4B611C56AD37FA14A0EB4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

onyxc2

C2

svn555634dm.click

Attributes

port
443
url_path
/backend/api/app.php

Targets

- Target
  Fling-Standalone25.264.54874.zip
- Size 41.2MB
- SHA256 5d48e83132f69c6ded86e7ced5a6b80b87d79ddefcc909105d2f84e89a9f9b5c
- MD5 301a6526bbb4f0c86fc0b668c2776847
- SHA1 0716fcf701e22d281b3ceedd300a88ce70d336b6
- SHA512 88d035ed937fa274c87d771838280a979995267aeae31a064226bcb99e2ab78b47bc99d3e51418a51ec1d337961a231a234a727561b3e9243127746a1225d900
- SSDEEP 786432:lDMbE/FP51gmE14FApxeYOKMPEOvJBBer/v8OZDANqKye3D2HAVy1bC+utQtUkZu:l8op5DEnpxoBJBwr/0OZo1y2y1W+u2U5
- TLSH
  T18F973305C8E5925F2C92FFA1C55C41AE7EF64032932A36C4B611C56AD37FA14A0EB4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Fling-Standalone62.629.6056.exe
- Size 3.4MB
- SHA256 41999a3d0da035ff8068905c90235ea50121329cb0661e38d745974ebf5e3ae2
- MD5 cf64c7e2e3897ae5fce3d5414e3d1d27
- SHA1 c333a821f1764abe2aed2c1ab27d2349f64e4264
- SHA512 3ac217e166ea07cdffb13c949100cf707041c7ee8e842ae4f35e0c529064b610fadcca2782e6de8c8e08e2649487a381f529fda3a53ec31da5ba1394c71d2fb1
- SSDEEP 49152:dcOFPISimLMS5M3B3Kul+XYbxzSv199mMc0NWd:F5z0
- TLSH
  T102F528AB72A4C279C15EC23FC0A28F10E537B1795773C5EB129106696B06AE49F3F760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery onyxc2 persistence spyware stealer adware ransomware
- Family: OnyxC2
  OnyxC2 is a Windows backdoor written in C++.
  backdoor onyxc2
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  borlndmm.dll
- Size 126.8MB
- SHA256 f644f67eabef3acd36c8ec87b2f49c4b120f598f2f34c771c90a5c8fa00aec20
- MD5 d668ddb207acee03f8a7c33b2d9c29d6
- SHA1 e0c83a6e981fc5e1b0608681cf61e01fe1548a93
- SHA512 04cc0169b8d12148a3b8345a47d8972dff4f4894b5aefd808352651402264d23cc69b36d63df064b8869c70485dd125220c59d23cb35fde6224462a4345b673a
- SSDEEP 3145728:UC/zu0PC/2u0KXwoyZ+R6ulKKaCe27T+J/P0:v/z4/2EXwZYRrlKUs10
- TLSH
  T17058DFC96282C8DBC68C4F78898BDFB4D4ADAC0B003656D74AD83D2F1D77AF84D16952
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6