Extracted

• • Target
    Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe
  • Size 595.4MB
  • SHA256 231e5989881b9df333c2797bb8f980b31f7f19e235249d8021d5882e4bb3d728
  • MD5 13356f38caa74c0b52d4fcc83e61808a
  • SHA1 8862d97383ad70037f309dce7fd2008d2ba3b1e4
  • SHA512 09ec3a0032b655910cf869d793b384a837105c4409a4392c4da7034f472f7d3b09455d5854fff3079fed86f113e1d3d12b31bb84f968c5b235b13192a638ed25
  • SSDEEP 12582912:ZjGpKQ1rGl9Gwz4sG+APV5FK+Z8rJI4Z3JGFweqExtdVBqq:BGWPgsIPPIdETDHBqq
  • TLSH
    T1DB5933A4A170A177F39812F30A2E99187FFB63233510446175FEFB599C86A05C63BEC9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutiononyxc2persistenceprivilege_escalationransomwarespywaretrojanupxadware

  • Family: OnyxC2

    OnyxC2 is a Windows backdoor written in C++.

    backdooronyxc2

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2