# OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate, CGrabber, and Vidar via DLL Sideloading and gainmsg[.]com C2

> OnionDrop is an actively-delivered, payload-agnostic Windows malware loader (part of the LegionLoader/CurlyGate ecosystem documented by Cyderes' Howler Cell) that abuses DLL sideloading of an Adobe-signed AcroBroker.exe to execute a four-stage unpacking pipeline and deliver CGrabber, LegionLoader, and Vidar infostealers. It calls back to gainmsg[.]com/nfront.php and combines nation-state-grade evasion (GPU-based VM detection, dynamic API resolution, Donut shellcode via Thread Pool callbacks) at commodity scale, with 645+ unique DLL samples observed between Feb 28 and May 20, 2026.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0831
- **ID:** TL-2026-0831
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** OnionDrop operator
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OnionDrop is a multi-stage Windows loader tracked by the Cyderes Howler Cell Threat Research Team as the third documented component of a broader LegionLoader/CurlyGate operation that also includes the CGrabber infostealer and the Direct-Sys (APC injector) loader. Delivery occurs via ZIP archives that bundle a legitimate, Adobe-signed executable (setup.exe / AcroBroker.exe), two malicious DLLs (sqlite.dll and codecstore384d.dll), and a 100MB+ decoy data.bin file filled with random bytes to inflate archive size and frustrate automated scanning and upload limits.

Execution begins when AcroBroker.exe sideloads sqlite.dll, which on DLL_PROCESS_ATTACH uses LoadLibraryA to load codecstore384d.dll — the primary malicious DLL. codecstore384d.dll locates its encoded payload at a hardcoded offset (0xd9108 subtracted from the DLL file size) and runs a four-stage unpacking pipeline: (1) custom byte-pair decoding (stride 2) through a hardcoded 256-byte lookup table that maps the first byte to a high nibble and the second to a low nibble; (2) Xpress Huffman decompression via RtlDecompressBufferEx with COMPRESSION_FORMAT_XPRESS_HUFF, skipping a 0x3CDB-byte runtime offset, followed by a second byte-pair decode pass (stride 3); (3) AES-256-CBC decryption using rotating key material assembled incrementally via runtime XOR operations (one stage key: 27 2C 2A E0 E2 2F 8F 29 DC 43 F7 68 75 35 4D 83 37 7D 12 7A 67 0A 75 DA EF EF B3 A5 95 87 29 FE), with the first 16 bytes used as the IV and the remainder as ciphertext; and (4) execution of a Donut-generated shellcode payload, with the final PE decompressed via RtlDecompressBuffer using COMPRESSION_FORMAT_LZNT1.

Shellcode is mapped using native NTAPI (NtAllocateVirtualMemory, NtWriteVirtualMemory), with memory transitioned RW→RX via NtProtectVirtualMemory, and is executed by abusing the Windows Thread Pool callback API chain (TpAllocWork → TpPostWork → TpWaitForWork → TpReleaseWork) to avoid standard thread-creation telemetry. Where a direct thread is required, the loader uses NtCreateThreadEx to spawn its execution thread and returns from DllMain immediately, avoiding Loader Lock deadlock.

The loader employs extensive anti-analysis: GPU/VM detection via EnumDisplayDevicesA, comparing display-adapter strings with strstr against a decrypted whitelist (INTEL, GTX, ARC, AMD, RTX, QUADRO, RADEON, GEFORCE) and halting in unrecognized (virtualized) environments; dynamic API resolution via LdrGetProcedureAddress and LdrLoadDll (used to load bcrypt.dll for the BCrypt* decryption chain) to bypass hooked LoadLibrary/GetProcAddress; stack-string construction that builds sensitive symbol names (e.g., NtCreateThreadEx) character-by-character at runtime; rotating per-stage AES keys; and API hammering (flooding sandbox traces with irrelevant calls).

Delivered payloads evolved over the campaign: early February samples dropped the CGrabber infostealer, mid-campaign samples delivered LegionLoader/CurlyGate (RC4-decrypted configuration, callback to gainmsg[.]com/nfront.php over HTTPS using a Vivaldi-spoofing User-Agent), and the most recent samples delivered Vidar Stealer, sometimes through an intermediate Direct-Sys loader stage forming a five-stage chain. Cyderes characterizes the operator as a high-tempo threat actor running multiple infostealer operations simultaneously with nation-state-grade evasion architecture but commodity targeting at scale. There is no associated CVE; the threat is a delivery/evasion technique cluster with confirmed in-the-wild activity.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1106 Native API
- T1620 Reflective Code Loading
- T1574 Hijack Execution Flow
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1055 Process Injection
- T1082 System Information Discovery
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1041 Exfiltration Over C2 Channel

## Sources

- [OnionDrop: Commoditized Loader with Nation-State-Grade Evasion](https://www.cyderes.com/howler-cell/oniondrop-malware-analysis)
- [New OnionDrop Loader Campaign Uses gainmsg C2 to Deliver LegionLoader Payloads](https://cybersecuritynews.com/new-oniondrop-loader-campaign-uses-gainmsg-c2/)
- [Hackers Use OnionDrop Loader With DLL Sideloading to Deploy Multiple Infostealers](https://gbhackers.com/oniondrop-loader-with-dll-sideloading/)
- [OnionDrop Loader Uses Nation-State-Grade Evasion to Deliver LegionLoader, CGrabber, and Vidar](https://cyberpress.org/oniondrop-loader-evades-detection/)
- [Direct-Sys Loader and CGrabber Stealer Five-Stage Malware Chain](https://www.cyderes.com/howler-cell/direct-sys-loader-cgrabber-stealer-five-stage-malware-chain)
- [OnionDrop: Commoditized Loader with Nation-State-Grade Evasion (Malware.news mirror)](https://malware.news/t/oniondrop-commoditized-loader-with-nation-state-grade-evasion/107783)
- [LegionLoader exposed - TEHTRIS](https://tehtris.com/en/blog/legionloader-exposed/)
- [LegionLoader: New distribution campaign detected - ACN (Italy CERT)](https://www.acn.gov.it/portale/en/w/legionloader-rilevata-nuova-campagna-di-distribuzione-malware)
- [From Fake Installers to Stolen Credentials: Decoding the LegionLoader Threat](https://securityonline.info/from-fake-installers-to-stolen-credentials-decoding-the-legionloader-threat/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0831