MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 066ecd627caec87426bd94db4f0c1ec45b8345e26b0cace2e8193a91155ce5ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

OnyxC2

Vendor detections: 5

Intelligence 5 IOCs YARA 22 File information Comments

SHA256 hash:	066ecd627caec87426bd94db4f0c1ec45b8345e26b0cace2e8193a91155ce5ee
SHA3-384 hash:	78b51706a4b8825764de3e80f5a5a981c3bf5e66194a6b2918817e00c27cf79497b67254694cf2d5d8d11dbeb806fbef
SHA1 hash:	214e742c224932cef5fd03ad277597007a983c35
MD5 hash:	8590407494ce4ef4bca70d2e3d84ad07
humanhash:	oven-fourteen-green-blue
File name:	packagecache_x64_data.zip
Download:	download sample
Signature	OnyxC2 Create hunting rule
File size:	8'586'695 bytes
First seen:	2026-08-20 18:44:56 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:uIsrmuN8E5OCgewucziS/FFPP8kzKGw1C6AgKnvCvg5OkBarP2:J48E4CgewuMX/zPTzKGw8DQSs2
TLSH	T1998633D480F2CC6A7D3B836DCDB55652EDD8C60E2605A5FA71A5A20304E77C17BBE22C
Magika	zip
Reporter	aachum
Tags:	akmuniverstall-top getintoway-com OnyxC2 zip

iamaachum

https://cdn.corehubpro.com/packagecache_x64_data.zip

OnyxC2 C2:
https://akmuniverstall.top/7e243e2b5c5ds7he/backend/api/app.php

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

File Archive Information

This file archive contains 8 file(s), sorted by their relevance:

File name:	vcruntime140_1.dll
File size:	47'264 bytes
SHA256 hash:	e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 hash:	03b43160d21c08de07a79d0a1c5ee81d
MIME type:	application/x-dosexec
Signature	OnyxC2

File name:	libintl-8.dll
File size:	298'731 bytes
SHA256 hash:	0537c3dd2378218508ebe3cc416d72a99ee2d24ae1c5525e23458f32544ef861
MD5 hash:	edf8f1b85f2f01ff0a28a6a31c3e427d
MIME type:	application/x-dosexec
Signature	OnyxC2

File name:	vcruntime140.dll
File size:	123'472 bytes
SHA256 hash:	184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 hash:	0d35c5e99871b4f02c490b9fd9dace34
MIME type:	application/x-dosexec
Signature	OnyxC2

File name:	libiconv-2.dll
File size:	1'143'148 bytes
SHA256 hash:	7a282a854e01be726c6cccfe46f548c716aa45b3014818468253aaa4efbcd067
MD5 hash:	987a6b7cd60f6c108550ebfc1771b911
MIME type:	application/x-dosexec
Signature	OnyxC2

File name:	libwinpthread-1.dll
File size:	64'185'856 bytes
SHA256 hash:	0db0571c24997deae85af1e701c41cb44f83446f438ec8e2f82e0d1ba7c740fa
MD5 hash:	c3246593612e21011d59eb900f3c1109
MIME type:	application/x-dosexec
Signature	OnyxC2

File name:	zlib1.dll
File size:	128'488 bytes
SHA256 hash:	93e9243a44c29200eeacaf9658efe2558581770e4b11ca4b500e18e424a6e3b5
MD5 hash:	30a31b969a3356efde11078dc635baa0
MIME type:	application/x-dosexec
Signature	OnyxC2

File name:	git-remote-https.exe
File size:	2'629'024 bytes
SHA256 hash:	f4c9d7f2f85b795603f501c25ad63fff82fce233ae0fc3d48e4e3c8669e5d788
MD5 hash:	6378ee9dec487a41349a1a2d9700ab89
MIME type:	application/x-dosexec
Signature	OnyxC2

File name:	libpcre2-8-0.dll
File size:	717'955 bytes
SHA256 hash:	c135a87ed0f11eae8ffc4cb469671ff0b3f5d71fab5fb024e9b1e7241ca25b52
MD5 hash:	86f36fe5c094d844ac79cdd58dc6c8dd
MIME type:	application/x-dosexec
Signature	OnyxC2

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/cfdd6c08-9f54-467c-aad4-1411eaa1f717/

Detection(s):

Win.Malware.Aotera-10060486-0

Result

Verdict:

Clean

File Type:

PE File

Link:

https://app.docguard.net/066ecd627caec87426bd94db4f0c1ec45b8345e26b0cace2e8193a91155ce5ee/results/dashboard

Verdict:

Unknown

Threat level:

n/a -.1.0/10

Confidence:

100%

Tags:

adaptive-context anti-debug base64 crypto expand expired-cert lolbin overlay packed reconnaissance signed

Link:

https://www.filescan.io/uploads/6a874b4236d7dd66acdbc2e8/reports/2d5d2aaf-ddae-4767-b036-c51f7f30f5a3/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/066ecd627caec87426bd94db4f0c1ec45b8345e26b0cace2e8193a91155ce5ee

Score:

90%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/