Overview

overview

10

Static

static

5

Fling-Stan...05.exe

windows10-2004-x64

10

Fling-Stan...05.exe

windows11-ltsc_2024-x64

5

jli.dll

windows10-2004-x64

10

jli.dll

windows11-ltsc_2024-x64

7

main_jli.dll

windows10-2004-x64

10

main_jli.dll

windows11-ltsc_2024-x64

7

msvcp140.dll

windows10-2004-x64

1

msvcp140.dll

windows11-ltsc_2024-x64

1

ucrtbase.dll

windows10-2004-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140.dll

windows11-ltsc_2024-x64

1

vcruntime140_1.dll

windows10-2004-x64

1

vcruntime140_1.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Fling-Standalone13.957.41839.zip
  • Size 10.4MB
  • Sample260725-cydnqafd54
  • SHA256 0e53b2f5a6bf7cc1d674bc3299acf7259ddace932b6f81474a3bf51537236d5e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
onyxc2backdoordiscovery

Malware Config

Extracted

Family

  • onyxc2

C2

  • akmuniverstall.top

Attributes
  • port

    443

  • url_path

    /7e243e2b5c5ds7he/backend/api/app.php

Targets

    • Target
      Fling-Standalone52.268.5705.exe
    • Size 24KB
    • SHA256 208c9829ff7f1600b5b446f95900a476b9c5b6e75e9c809bca31ff73b23b7e38
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryonyxc2

    • Family: OnyxC2

      OnyxC2 is a Windows backdoor written in C++.

      backdooronyxc2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      jli.dll
    • Size 130.7MB
    • SHA256 20071046c38bd051d505fc3cc520faf362be5ae54708bd8601f2b9a17e56a803
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryonyxc2

    • Family: OnyxC2

      OnyxC2 is a Windows backdoor written in C++.

      backdooronyxc2

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral3behavioral4
    • Target
      main_jli.dll
    • Size 56.3MB
    • SHA256 30f9795402b7259e9bd867fc45a8c3a1996085292c300f782af53980b8567649
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryonyxc2

    • Family: OnyxC2

      OnyxC2 is a Windows backdoor written in C++.

      backdooronyxc2

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral5behavioral6
    • Target
      msvcp140.dll
    • Size 540KB
    • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      ucrtbase.dll
    • Size 1.3MB
    • SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      vcruntime140.dll
    • Size 120KB
    • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral11
    • Target
      vcruntime140_1.dll
    • Size 46KB
    • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12behavioral13

MITRE ATT&CK Enterprise v16

Tasks