OnyxC2 lure archive execution (Setup_File/Fling-Standalone) from user directory

Duo Tech@duotech

•updated Aug 14, 2026•0•0•2

Detects extraction and execution of OnyxC2 lure archives (Setup_File*.zip, Fling-Standalone*.zip) via WinRAR/7-Zip from a Downloads/Temp directory, correlating the archive-open with the lure-named installer executing shortly after.