Overview

overview

10

Static

static

3

2026-10-19...id.exe

windows10-2004-x64

10

2026-10-19...id.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-19_f306306ce5dd49aaee6b6cfb05dcbcd5_cobalt-strike_icedid
  • Size 3.1MB
  • Sample261020-aps1yaaz6s
  • SHA256 b12520e285832c365c7c9a8ee35b3254073f6c420c94a87d591d3eb2b0d0ca92
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
onyxc2backdoordiscovery

Malware Config

Extracted

Family

  • onyxc2

C2

  • flyfileclouddd.click

Attributes
  • port

    443

  • url_path

    /NQsPERpH/backend/api/app.php

Targets

    • Target
      2026-10-19_f306306ce5dd49aaee6b6cfb05dcbcd5_cobalt-strike_icedid
    • Size 3.1MB
    • SHA256 b12520e285832c365c7c9a8ee35b3254073f6c420c94a87d591d3eb2b0d0ca92
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryonyxc2

    • Family: OnyxC2

      OnyxC2 is a Windows backdoor written in C++.

      backdooronyxc2

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks