onyxc2 | 1cb9ba31c514953895e07eafc44cd29d926b66bda3052e32ec8567019ba1bb9a

General

Target
fling_pair.zip
Size 5.1MB
Sample261027-errm4s1vgz
SHA256 1cb9ba31c514953895e07eafc44cd29d926b66bda3052e32ec8567019ba1bb9a
MD5 88e2e23d1a76dceb1af6f79a35fa2633
SHA1 97d263e7cc45cc8f1bded43f65d3a008a04e7a64
SHA512 dc0f8d77f3b14500202c60c6a5b6cb247461de6ce8f4964a500bf8cb9986226af12c04ae18467051354ffacb09fd95f8b6396223e779f10408317545ed4d35e8
SSDEEP 98304:H26Li/Gf/52qJ8Avup25IP3Mt/a6Y9tL6W+ZPSDqzrn7x4woohvBcx2dkL9Wbmj:H26LiOXQqJ8Amq7EfYZPSD2xvTcxvL9b
TLSH
T1903633E32B5EA619640E26FBB19449C361BC304F17A5370A37F028FE1676DC922D39D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

onyxc2

C2

sanssharessfile.click

Attributes

port
443
url_path
/Z4f5vmhR/backend/api/app.php

Targets

- Target
  Fling-Standalone25.355.2493.exe
- Size 3.4MB
- SHA256 2d7398c86e5a8509a8b12a0475ad181daa1232f3e2804fd88b04ea79ef915b86
- MD5 4fce9dcde8276fa747e6f3230f318099
- SHA1 ea1c37c4dee3eb1fa75efe63b9f930eb59b1fef6
- SHA512 0dcf30fbae56ef7eb380b9e0ffe74ff9c36303a47424e0429e007dab5f9225ac04a3a3cefde231e122fffa51284a73c80c57ee5610bc504294ee81a397d2e482
- SSDEEP 49152:UcOFPISimLMS5M3B3Kul+XYbxzSv199mMc0NWd:y5z0
- TLSH
  T15DF528AB72A4C279C15EC23FC0A28F10E537B1795773C5EB129106696B06AE49F3F760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery onyxc2
- Family: OnyxC2
  OnyxC2 is a Windows backdoor written in C++.
  backdoor onyxc2
behavioral1 behavioral2
- Target
  borlndmm.dll
- Size 77.5MB
- SHA256 02031593f073b38ac7280a1bbeca804f451a473ec0603814f1ca42835d802e76
- MD5 45bb7b850a24e29b30c1e8cbe04899eb
- SHA1 535a707bcb75503d44b07d9f1b5768e2605c6480
- SHA512 e2d751d883fa7090a3f7adfcaff55109181dd4efe95f316c4a377d56a179c4644bb48c27e4ba4e3798be66c29d208b1f7a81da0146d1e9a354279533535efa6c
- SSDEEP 98304:oWBM3/CIxSkSRk/oheqHhWuhqfaSu4czKiSMmJR56SZkJ9Jrr01F:o8QEPk/bBrfaShczKiSMmJK9Jrr0H
- TLSH
  T1EB0833536FA98273E53B00729A97984A9F70B40017A4A7FF135C499A5F1B7C6DCB2B30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: OnyxC2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4