429a12e09e66bd87deb257a6c4d2193e5b4ae08aea2c1758093891fb7e321b78

Sharing

Copy URL Twitter E-mail

General

Target
Onyx V4 APP + MAGNUS-20260827T090707Z-1-001.zip
Size 82.9MB
Sample260827-k4cbvafn3s
SHA256 429a12e09e66bd87deb257a6c4d2193e5b4ae08aea2c1758093891fb7e321b78
MD5 8d713166044a88076adad80e3e4ff341
SHA1 0e15ae7372a4cb9429d8a811f73ac36a8dcdbdd8
SHA512 b543ceac7bc859026b084021d3e6621dc627265444f40b69eed93271edaf1aa7ea30d926d127cd33afa1aab9df95c700cf93f131aaa56f742784d316b357b2f5
SSDEEP 1572864:/LjYbRjrkOnr1UsdpsFPNBWmj57yyAxK3/wAaXDPC5cuS+rDUW5KXpwM511F8fgk:DjYbRjxrLpsFPNjdGKIdu5f1X5K2oqfJ
TLSH
T16E183316410B5C21AA35C1359F42A5E4D21BA84386652C932B46BF27FFCE1E72F0BD7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Onyx V4 APP + MAGNUS/Magnus + Opencode Jb Prompt /JB FOR OPENCODE + SYSTEM PROMPT FOR MAGNUS/ALEXANDER PROMPT.docx
- Size 15KB
- SHA256 22a96f303d5ba57dc0090f3c624c45217916f8a1ea4179eb71b8b5bf0d1bb3b0
- MD5 f395b67ec60e12c32e16a8b2762052ed
- SHA1 0078935d574f65d802fccbb4ede7039b7631719e
- SHA512 6e2945840e1d525bf125ea4ab43d07b143b42296f2ac27a31c17ded5d1a79ea04ba860082c013732eb411b8c5146d453c085a066f43a2a75da71de5e3920295b
- SSDEEP 384:X5sr3QsfJAIat6RjpAY6ueYuROo0HVmNAoYrTJ8p7mU7:XGr3QsfJA3tCAYIUo01mSoYvJ8p7r
- TLSH
  T10772C024D196A5F5C3268171C25B9051DD5CCA86F72E84D303621AC4C7A9837B7B3FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence ransomware
behavioral1
- Target
  Onyx V4 APP + MAGNUS/Magnus + Opencode Jb Prompt /MAGNUS BUILD/Linux/build-linux.sh
- Size 120B
- SHA256 c1198e67442fde79ce7e2a9cf69d944a8ce6004befdc8b413c9e2699a20320e2
- MD5 65b292210f52611aa68fc57d8466a673
- SHA1 ee17b27633398e0cc317bd1eda7126f3bb940dc5
- SHA512 b89cc71f5ec3004d4d0cd4a43dbb8bb3aebdece33684c0fb2ef6b1f1f420ffa19e3fc45b345f6340297e17123983e3da7c9c14d0b66835b855f2873b1bfa9d73
- TLSH
  T106B0922659164EA8421A7B42894447C58DF290BB826DBA9888E12A56D2613C27485E6E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  MAGNUS.exe
- Size 11.7MB
- SHA256 04b722601230fc5e0b2d5b47833166dd3bef62d9dedceb674aae16f32d6bd345
- MD5 5f3dd240c31977238aa2352b1efcd3df
- SHA1 836d0b9702eb01bf3e1a0e40bc5373d9cc75fd71
- SHA512 82cfaed06574ecb6a67e18c7ae37aca8a266cfb561be8441f20d0deaace724fea597f80307daf5534a298b4b9110a9a8a36f729645d4f0a7cb1748cadcbbe276
- SSDEEP 196608:/MDkWgSz2Hiqs5CGppi9WjwtL3cUiq0v0AJWTNoTYp9eW2pZ59oe2a19uGQtCRZ:/Exz2Hiqs4Gpk9WjwtLsUiqA0AJtc2pF
- TLSH
  T17EC633036562881BC766C0346B4B94D5D03FB4C1879624E36BD0F86F3D660F59F3AAAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3
- Target
  Onyx V4 APP + MAGNUS/Magnus + Opencode Jb Prompt /MAGNUS BUILD/Windows/MAGNUS.exe
- Size 11.7MB
- SHA256 04b722601230fc5e0b2d5b47833166dd3bef62d9dedceb674aae16f32d6bd345
- MD5 5f3dd240c31977238aa2352b1efcd3df
- SHA1 836d0b9702eb01bf3e1a0e40bc5373d9cc75fd71
- SHA512 82cfaed06574ecb6a67e18c7ae37aca8a266cfb561be8441f20d0deaace724fea597f80307daf5534a298b4b9110a9a8a36f729645d4f0a7cb1748cadcbbe276
- SSDEEP 196608:/MDkWgSz2Hiqs5CGppi9WjwtL3cUiq0v0AJWTNoTYp9eW2pZ59oe2a19uGQtCRZ:/Exz2Hiqs4Gpk9WjwtLsUiqA0AJtc2pF
- TLSH
  T17EC633036562881BC766C0346B4B94D5D03FB4C1879624E36BD0F86F3D660F59F3AAAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Onyx V4 APP + MAGNUS/Magnus + Opencode Jb Prompt /MAGNUS BUILD/macOS/build-macos.sh
- Size 120B
- SHA256 172f5186b1783d4cd99b38699226a52747cb83080f097aecc10a0885d504248b
- MD5 9f076c4dfd7e4fc84e79e26ac8b89719
- SHA1 3b28f2968d6506ce345af0abb86b2c3697ef755a
- SHA512 3fbb9d3ef9e3e8ea91672caa78ad32e41d4f2012d28834e6344fdb0a694532cd880b79958e531fb57fcd61020f4b250474525e12e60a8ba1f649b217b0fbf9b6
- TLSH
  T1D6B09226590A8DA8425A67428A444AC1CDF290BB416DB98888E52E66D2612C23485A2E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  Onyx V4 APP + MAGNUS/ONYX V4 BUILD/Linux/build-linux.sh
- Size 706B
- SHA256 ca6476829dfafe0490167a8c39a0b467690c76e6b77bf232dc371f5450d3462a
- MD5 0da5ebeca930f32d62d0627b3c498ed2
- SHA1 14c5383cb7416da772c08b0615865980b4651bf7
- SHA512 7b64d1a021763373f997c2c7dad5a4ae423b8bbefb90e41c4563e0e3451b2345d8c1c1c64500f58d8b6b9e74f0f0a5bf6a0a47e5df8bb890fcd5d4eb3730038a
- TLSH
  T1D8019429B1247575156E1B2CBDA21293858533D7176F5B5C30BD15CC8CF3D953553B03
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6
- Target
  Onyx V4 APP + MAGNUS/ONYX V4 BUILD/Windows/Onyx V4.exe
- Size 29.9MB
- SHA256 c8a34d424f4f02279c47fbfc13ce9830ce2d866866824891d553210b909ebd7d
- MD5 a52ce89c930467251f66b045138a2209
- SHA1 2e2d9aacccf6fceb7f54362c8a7e0dca62351933
- SHA512 3789f71a4f3070acba0009ba928be3032fa93836614741715021b1c57a58df20e4e8311901fec02fdc6b634173577b5980eb74cc531c987fb643f966ccf1f50a
- SSDEEP 786432:wqq+hwNiJZ6+gMICG8bGUitz3KlTpi0CQzP7LN9h:DqNyFgMFn1itTKlFykP7LT
- TLSH
  T143673311924B5834EA32D4B0D9427270E716BC53466548A31FE22E22FFDD6F61F2BD3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Onyx V4.exe
- Size 29.9MB
- SHA256 c8a34d424f4f02279c47fbfc13ce9830ce2d866866824891d553210b909ebd7d
- MD5 a52ce89c930467251f66b045138a2209
- SHA1 2e2d9aacccf6fceb7f54362c8a7e0dca62351933
- SHA512 3789f71a4f3070acba0009ba928be3032fa93836614741715021b1c57a58df20e4e8311901fec02fdc6b634173577b5980eb74cc531c987fb643f966ccf1f50a
- SSDEEP 786432:wqq+hwNiJZ6+gMICG8bGUitz3KlTpi0CQzP7LN9h:DqNyFgMFn1itTKlFykP7LT
- TLSH
  T143673311924B5834EA32D4B0D9427270E716BC53466548A31FE22E22FFDD6F61F2BD3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral8
- Target
  Onyx V4 APP + MAGNUS/ONYX V4 BUILD/macOS/build-macos.sh
- Size 767B
- SHA256 5e420298ed5bbb07559174b877fa6b156ee45bda397f8b565555098cc9ee91f7
- MD5 d45a96c3d3248bfdd96976d8299ace93
- SHA1 62609a8bddc6ac998805a65ada02606171be30a1
- SHA512 ab2d0cf7604f71a09244447b765d9df55ed3b847eda2e7770f7ab39c51f6de9e69f15212b88b173074f664d731561b6b8eb771d77980cfd4c18e31d253ca991d
- TLSH
  T1B501201AF6942970045D072CBDA13223848073D71BEF1A0C20BC55CD84F38643253703
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks whether UAC is enabled

Network Share Discovery

Loads dropped DLL

Checks whether UAC is enabled

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9