Malware

CGrabber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1204.002Malicious FileEvidence1

MITRE Initial Access: T1204.002 – User Execution: Malicious File Execution

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

MITRE Defense Evasion: T1027 – Obfuscated Files or Information

T1497.001System ChecksEvidence1

The loader queries display device information via EnumDisplayDevicesA... decrypts a hardcoded list of known hypervisor and analysis-environment display device strings... If any match is detected, the loader silently terminates execution.

T1497.002User Activity Based ChecksEvidence1

Before decrypting and executing the next in-memory shellcode, the Stage-1 loader performs three primary checks... Text File Check... Active Process Check... Display Device Check.

T1620Reflective Code LoadingEvidence1

The PE is then loaded reflectively into memory, after which execution is redirected to its entry point.

Credential Access

2 techniques

T1552.001Credentials In FilesEvidence1

File Paths and Filenames (Regex Patterns) *wallet*.*, *seed*.*, *btc*.*, *key*.*, *2fa*.*, *crypto*.*, *coin*.*, *private*.*, *auth*.*

T1555Credentials from Password StoresEvidence1

The stealer then shifts its focus to Chromium and Gecko based browsers, extracting sensitive artifacts such as saved passwords, credit cards, browsing history, session cookies, and browser-stored wallet data.

Discovery

6 techniques

T1012Query RegistryEvidence1

The stealer begins its execution by retrieving the MachineGuid value from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography

T1057Process DiscoveryEvidence1

It then proceeds to enumerate all active processes on the system, collecting the Process ID, Session ID, Process Name, and corresponding command-line arguments.

T1082System Information DiscoveryEvidence1

After obtaining the session ID... this includes a broad set of system attributes such as the current timestamp, GPU model, RAM and CPU specifications, MachineGuid, and other environment details.

T1497.001System ChecksEvidence1

T1497.002User Activity Based ChecksEvidence1

Before decrypting and executing the next in-memory shellcode, the Stage-1 loader performs three primary checks... Text File Check... Active Process Check... Display Device Check.

T1518.001Security Software DiscoveryEvidence1

After collecting the list of active processes, the stealer iterates through it again to identify any running antivirus or security solutions.

Collection

3 techniques

T1005Data from Local SystemEvidence1

A single successful infection yields: Complete credential takeover... Cryptocurrency access... Infrastructure pivot points... Identity aggregation

T1114Email CollectionEvidence1

Mail Clients Foxmail, Thunderbird, The Bat!, Mailbird

T1119Automated CollectionEvidence1

The stealer aggregates all files destined for exfiltration into a ZIP archive, which it keeps solely in memory.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

The stealer constructs the HTTP headers for its POST request on endpoint /api/auth to the C2... The ZIP metadata... is transmitted to the C2 server via a POST request to the /api/upload/start endpoint

T1105Ingress Tool TransferEvidence1

OnionDrop is a sophisticated multi-stage malware loader designed to deliver InfoStealers such as LegionLoader (CurlyGate), CGrabber, and Vidar Stealer at scale.

Exfiltration

2 techniques

T1030Data Transfer Size LimitsEvidence1

If the ZIP archive exceeds 1 MB in size, the stealer transmits it in 1 MB chunks to the C2 server using the /api/upload/chunk endpoint.

T1041Exfiltration Over C2 ChannelEvidence1

The completed archive is then transmitted via a POST request to the /api/upload/complete endpoint.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

Before decompressing the next-stage PE, the shellcode patches the in-memory implementations of AmsiScanBuffer, AmsiScanString, and EtwEventWrite at runtime to bypass user mode hooks.

INDICATORS OF COMPROMISE

IOCs tracked for this family

75 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

69 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

gurucul threat researchNews

Jun 12, 2026

Dissecting OnionDrop: Commoditized Loader with Nation-State-Grade Evasion | Community Portal | Gurucul

An information-stealing payload delivered by OnionDrop.

cyderes blogNews

Jun 11, 2026

OnionDrop: Commoditized Loader with Nation-State-Grade Evasion

An infostealer delivered by OnionDrop in earlier campaign waves and one of the confirmed final payloads tracked in the same activity cluster.

cyderes blogNews

Apr 16, 2026

Direct-Sys Loader and CGrabber Stealer Five-Stage Malware Chain

A previously unreported information stealer that harvests browser credentials, cookies, payment data, crypto wallet data, password manager data, VPN configurations, FTP credentials, SSH keys, messaging app artifacts, and other host information, then exfiltrates the data in an in-memory ZIP encrypted with ChaCha20 and authenticated with HMAC-SHA256 over HTTP POST requests.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching75

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

CGrabber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1204.002Malicious FileEvidence1

MITRE Initial Access: T1204.002 – User Execution: Malicious File Execution

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

MITRE Defense Evasion: T1027 – Obfuscated Files or Information

T1497.001System ChecksEvidence1

T1497.002User Activity Based ChecksEvidence1

Before decrypting and executing the next in-memory shellcode, the Stage-1 loader performs three primary checks... Text File Check... Active Process Check... Display Device Check.

T1620Reflective Code LoadingEvidence1

The PE is then loaded reflectively into memory, after which execution is redirected to its entry point.

Credential Access

2 techniques

T1552.001Credentials In FilesEvidence1

File Paths and Filenames (Regex Patterns) *wallet*.*, *seed*.*, *btc*.*, *key*.*, *2fa*.*, *crypto*.*, *coin*.*, *private*.*, *auth*.*

T1555Credentials from Password StoresEvidence1

Discovery

6 techniques

T1012Query RegistryEvidence1

The stealer begins its execution by retrieving the MachineGuid value from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography

T1057Process DiscoveryEvidence1

It then proceeds to enumerate all active processes on the system, collecting the Process ID, Session ID, Process Name, and corresponding command-line arguments.

T1082System Information DiscoveryEvidence1

After obtaining the session ID... this includes a broad set of system attributes such as the current timestamp, GPU model, RAM and CPU specifications, MachineGuid, and other environment details.

T1497.001System ChecksEvidence1

T1497.002User Activity Based ChecksEvidence1

Before decrypting and executing the next in-memory shellcode, the Stage-1 loader performs three primary checks... Text File Check... Active Process Check... Display Device Check.

T1518.001Security Software DiscoveryEvidence1

After collecting the list of active processes, the stealer iterates through it again to identify any running antivirus or security solutions.

Collection

3 techniques

T1005Data from Local SystemEvidence1

A single successful infection yields: Complete credential takeover... Cryptocurrency access... Infrastructure pivot points... Identity aggregation

T1114Email CollectionEvidence1

Mail Clients Foxmail, Thunderbird, The Bat!, Mailbird

T1119Automated CollectionEvidence1

The stealer aggregates all files destined for exfiltration into a ZIP archive, which it keeps solely in memory.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

T1105Ingress Tool TransferEvidence1

OnionDrop is a sophisticated multi-stage malware loader designed to deliver InfoStealers such as LegionLoader (CurlyGate), CGrabber, and Vidar Stealer at scale.

Exfiltration

2 techniques

T1030Data Transfer Size LimitsEvidence1

If the ZIP archive exceeds 1 MB in size, the stealer transmits it in 1 MB chunks to the C2 server using the /api/upload/chunk endpoint.

T1041Exfiltration Over C2 ChannelEvidence1

The completed archive is then transmitted via a POST request to the /api/upload/complete endpoint.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

Before decompressing the next-stage PE, the shellcode patches the in-memory implementations of AmsiScanBuffer, AmsiScanString, and EtwEventWrite at runtime to bypass user mode hooks.

INDICATORS OF COMPROMISE

IOCs tracked for this family

75 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

69 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

gurucul threat researchNews

Jun 12, 2026

Dissecting OnionDrop: Commoditized Loader with Nation-State-Grade Evasion | Community Portal | Gurucul

An information-stealing payload delivered by OnionDrop.

cyderes blogNews

Jun 11, 2026

OnionDrop: Commoditized Loader with Nation-State-Grade Evasion

An infostealer delivered by OnionDrop in earlier campaign waves and one of the confirmed final payloads tracked in the same activity cluster.

cyderes blogNews

Apr 16, 2026

Direct-Sys Loader and CGrabber Stealer Five-Stage Malware Chain

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching75

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.