Noir Crypto Wallet Drainer Abuses DNS-over-HTTPS for C2: OTX Pulse Analysis — Enterprise Detection Pack

Threat Summary

AlienVault OTX pulse data, sourced from Infoblox threat research, documents an active cryptocurrency wallet-draining kit designated Noir. The campaign represents a meaningful evolution in criminal tooling: rather than relying on hardcoded C2 domains or static phishing infrastructure, the Noir loader resolves its active command-and-control and lure-hosting infrastructure dynamically via DNS TXT records queried over DNS-over-HTTPS (DoH) against public resolvers. Operators can redirect every deployed lure globally by modifying a single DNS record — a takedown-resistant, infrastructure-as-code approach to criminal operations.

The kill chain is phishing-driven: victims are lured to drainer pages (notably hosted on Cloudflare Pages, abusing legitimate CDN trust), where wallet connection requests trigger malicious transaction approvals. Critically, Noir does not harvest seed phrases or private keys. Instead, it abuses wallet permissions — tricking victims into signing approvals or permit-style transactions that grant the operator spend authority over token balances. This shifts the theft model from credential theft to authorization abuse, which defeats traditional "seed phrase" user awareness training.

The pulse also flags the kit as AI-developed, consistent with a broader trend of LLM-accelerated crimeware development reducing time-to-market for drainers. Attribution is currently unknown; the operation pattern — reusable kit, dynamic DNS redirect, commodity hosting — suggests a drainer-as-a-service (DaaS) model where affiliates deploy lures while core operators manage the DNS pivot layer.

Objective: direct theft of cryptocurrency assets from victim wallets via malicious transaction signing, with C2 agility to survive blocklisting and infrastructure takedowns.

Threat Actor / Malware Profile

Malware family: Noir (crypto wallet drainer kit) Attribution: Unknown; likely Drainer-as-a-Service operators with affiliate distribution Development characteristics: Assessed as AI-assisted/AI-developed code, enabling rapid iteration of lure templates and loader logic

Distribution Method

• Phishing lures impersonating airdrops, token claims, NFT mints, and wallet "verification" portals
• Lure pages hosted on Cloudflare Pages (*.pages.dev style infrastructure), inheriting the trust and availability of a major CDN
• Likely promoted via malvertising, compromised websites, Discord/Telegram spam, and hijacked social accounts (typical drainer distribution)

Payload Behavior

• Browser-based drainer: executes in the victim's session when a Web3 wallet (e.g., MetaMask-class wallets) connects to the lure page
• Requests malicious approve / permit / setApprovalForAll signatures; once signed, operators drain token balances at will
• No seed phrase or private key collection required — authorization is the payload

C2 Communication

• Loader queries public DoH services (HTTPS-encapsulated DNS) to resolve TXT records for pivot domains such as noir.black and r.noir.black
• TXT record contents encode the current active lure/C2 destination; operators retarget the entire fleet by editing one record
• DoH abuse blends C2 discovery into legitimate HTTPS traffic to major resolver endpoints, defeating DNS-layer inspection and domain blocklists

Persistence Mechanism

• Client-side: none required in the traditional sense — persistence is achieved at the infrastructure layer. The drainer page itself is ephemeral; the DNS TXT pivot provides durable campaign continuity across hosting takedowns
• Wallet-side persistence: granted token approvals remain valid until explicitly revoked on-chain, giving operators a persistent theft capability independent of the malware

Anti-Analysis Techniques

• DoH encapsulation hides DNS queries from enterprise DNS telemetry
• Dynamic TXT-record indirection defeats static IOC blocklists; the observable domain may remain stable while destinations rotate
• Abuse of Cloudflare Pages and reputable DoH resolvers places malicious traffic inside allowlisted, high-reputation infrastructure

IOC Analysis

The pulse contains two indicators:

Operationalization guidance for SOC teams:

1. Block at DNS and proxy layers — sinkhole noir.black and *.noir.black at recursive resolvers and secure web gateways. Note: because the loader uses DoH, enterprise DNS blocking alone is insufficient; you must also control DoH egress.
2. Hunt TXT-record lookups — internal DNS logs will not show DoH queries. Instead, hunt for HTTPS connections from endpoints to known public DoH resolvers (Google, Cloudflare 1.1.1.1, Quad9, etc.) from processes that have no business performing DNS resolution (browsers and OS resolvers are expected; script interpreters and unknown binaries are not).
3. Cloudflare Pages telemetry — alert on outbound connections to *.pages.dev domains from endpoints in roles with no developer need, correlated with subsequent wallet-extension activity.
4. Tooling for decoding: doggo, dig (dig TXT noir.black @1.1.1.1), or curl against DoH JSON endpoints (https://cloudflare-dns.com/dns-query?name=noir.black&type=TXT with accept: application/dns-json) let analysts retrieve current TXT payloads for pivot extraction. Feed extracted destinations back into blocklists — this is where the real takedown value lives, since TXT contents change faster than the pivot domain.
5. On-chain follow-up: any confirmed victim wallet should have approvals audited and revoked via tools such as revoke.cash equivalents; approvals persist after endpoint cleanup.

Detection Engineering

---
title: Suspicious DNS-over-HTTPS Query to Public Resolver from Non-Browser Process
description: Detects processes other than known browsers/DoH clients establishing HTTPS connections to public DoH resolver endpoints, consistent with Noir drainer's DoH-based C2 discovery of TXT records for pivot domains like noir.black.
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: network_connection
  product: windows
detection:
  selection_doh_ip:
    DestinationIp:
      - '1.1.1.1'
      - '1.0.0.1'
      - '8.8.8.8'
      - '8.8.4.4'
      - '9.9.9.9'
  selection_doh_host:
    DestinationHostname|contains:
      - 'cloudflare-dns.com'
      - 'dns.google'
      - 'dns.quad9.net'
      - 'mozilla.cloudflare-dns.com'
  selection_port:
    DestinationPort: 443
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\svchost.exe'
  condition: (selection_doh_ip or selection_doh_host) and selection_port and not filter_browsers
falsepositives:
  - Legitimate DoH-enabled applications (some VPN clients, security tools)
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1572
  - noir
  - drainer
---
title: Noir Drainer Pivot Domain Resolution or Connection
description: Detects DNS queries or network connections to Noir wallet drainer pivot infrastructure (noir.black), used for DNS TXT record-based C2 redirection per OTX pulse and Infoblox research.
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: dns
detection:
  selection:
    query|contains:
      - 'noir.black'
  condition: selection
falsepositives:
  - Threat research and sandbox detonation
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.004
  - noir
  - crypto-drainer
---
title: Script Interpreter Spawning DNS or Network Tooling for TXT Record Lookup
description: Detects script interpreters and shells performing TXT record DNS lookups, a behavior consistent with drainer loader logic resolving Noir C2 destinations from DNS TXT records.
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\cmd.exe'
  selection_child:
    Image|endswith:
      - '\nslookup.exe'
      - '\dig.exe'
      - '\ Resolve-DnsName*'
  selection_txt:
    CommandLine|contains:
      - 'TXT'
      - '-type=txt'
      - 'Resolve-DnsName'
  condition: selection_parent and (selection_child or selection_txt)
falsepositives:
  - Administrative DNS troubleshooting
  - Email/DKIM/SPF validation scripts
level: medium
tags:
  - attack.discovery
  - attack.t1018
  - attack.command_and_control
  - noir

// Noir Drainer Hunt: DoH C2 discovery + pivot domain contact
// Microsoft Sentinel / Defender XDR
let DoHResolvers = dynamic(["1.1.1.1","1.0.0.1","8.8.8.8","8.8.4.4","9.9.9.9"]);
let DoHHosts = dynamic(["cloudflare-dns.com","dns.google","dns.quad9.net","mozilla.cloudflare-dns.com"]);
let NoirIOCs = dynamic(["noir.black","r.noir.black"]);
let BrowserProc = dynamic(["chrome.exe","firefox.exe","msedge.exe","brave.exe","opera.exe","svchost.exe"]);
let DoHConnections =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort == 443
    | where RemoteIP in (DoHResolvers) or RemoteUrl has_any (DoHHosts)
    | where not(InitiatingProcessFileName in~ (BrowserProc))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl;
let NoirContact =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (NoirIOCs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
let DoHEvents =
    DeviceEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "DnsQueryResponse"
    | where AdditionalFields has_any (NoirIOCs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, AdditionalFields;
union DoHConnections, NoirContact, DoHEvents
| sort by TimeGenerated desc

# Noir Drainer IOC Hunt - Enterprise Workstations
# Checks: DNS cache for noir.black pivot, DoH resolver connections,
# browser wallet-extension presence, and recent pages.dev lure contact artifacts.

$Results = @()

# 1. DNS client cache check for Noir pivot domains
$dnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match 'noir\.black$' }
if ($dnsHits) {
    $Results += [PSCustomObject]@{ Check = 'DNSCache'; Finding = ($dnsHits | Out-String).Trim(); Risk = 'CRITICAL' }
}

# 2. Active/historical TCP connections to known public DoH resolvers from suspicious processes
$dohIPs = @('1.1.1.1','1.0.0.1','8.8.8.8','8.8.4.4','9.9.9.9')
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $dohIPs -contains $_.RemoteAddress -and $_.RemotePort -eq 443 }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.ProcessName -notin @('chrome','firefox','msedge','brave','svchost')) {
        $Results += [PSCustomObject]@{ Check = 'DoH-NonBrowser'; Finding = "$($proc.ProcessName) (PID $($proc.Id)) -> $($c.RemoteAddress):443"; Risk = 'HIGH' }
    }
}

# 3. Check for Web3 wallet browser extensions (potential targeting surface)
$walletExtPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn",  # MetaMask
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn"
)
foreach ($p in $walletExtPaths) {
    if (Test-Path $p) {
        $Results += [PSCustomObject]@{ Check = 'WalletExtension'; Finding = "Wallet extension present: $p (elevated drainer targeting risk)"; Risk = 'INFO' }
    }
}

# 4. Browser history artifact check for Cloudflare Pages lures and noir.black
$chromeHistory = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History"
if (Test-Path $chromeHistory) {
    $tmpCopy = "$env:TEMP\hist_$([guid]::NewGuid().ToString('N')).db"
    Copy-Item $chromeHistory $tmpCopy -Force -ErrorAction SilentlyContinue
    # Requires sqlite3 or PSSQLite; fallback: string scan
    $raw = [System.IO.File]::ReadAllBytes($tmpCopy)
    $text = [System.Text.Encoding]::ASCII.GetString($raw)
    if ($text -match 'noir\.black') { $Results += [PSCustomObject]@{ Check = 'BrowserHistory'; Finding = 'noir.black found in Chrome history artifacts'; Risk = 'CRITICAL' } }
    if ($text -match 'pages\.dev') { $Results += [PSCustomObject]@{ Check = 'BrowserHistory'; Finding = 'Cloudflare Pages (*.pages.dev) visits found - review for lure pages'; Risk = 'MEDIUM' } }
    Remove-Item $tmpCopy -Force -ErrorAction SilentlyContinue
}

if ($Results.Count -eq 0) { Write-Output '[+] No Noir drainer indicators found on this host.' } else { $Results | Format-Table -AutoSize }

Response Priorities

Immediate (0-4 hours)

• Sinkhole noir.black and *.noir.black at recursive DNS resolvers and secure web gateways; add to threat intel platform blocklists
• Block or restrict outbound access to public DoH resolvers at the perimeter; force clients through enterprise DNS so TXT-record pivots become visible and blockable
• Pull current TXT records for noir.black via DoH JSON API and block any extracted redirect destinations
• Hunt all endpoints for non-browser DoH connections and browser history containing noir.black or suspicious *.pages.dev lure visits

24 Hours

• Wallet authorization audit (this campaign's credential-equivalent): Noir steals via signed approvals, not seed phrases. For any user who visited lure infrastructure, treat their wallet as compromised: audit on-chain token approvals (approve, permit, setApprovalForAll) and revoke all unverified grants immediately
• Identify which corporate or personal wallets were connected on affected endpoints; assess whether any corporate treasury, payment, or custodial wallets were exposed
• Notify affected users; require migration of remaining assets to fresh wallets where approvals were granted to unknown contracts
• Review web proxy logs for the preceding 30 days for Cloudflare Pages access patterns consistent with phishing lures (crypto claim, airdrop, mint keywords)

1 Week

• Architecture hardening: implement enterprise DoH egress control — block known public DoH endpoints by IP/hostname and enforce DNS via internal resolvers with logging of TXT queries
• Deploy browser isolation or extension allowlisting for roles handling corporate crypto assets; consider dedicated, hardened machines for any treasury operations
• Add detection content for wallet-drainer lure pages (brand impersonation, Web3 connect prompts on newly registered domains) to secure web gateway policies
• Update user awareness training: emphasize that wallet drainers steal via transaction approvals, not seed phrases — the "never share your seed" guidance no longer covers this threat class
• Establish continuous monitoring of OTX and drainer-focused feeds for new Noir pivot domains; expect TXT-record rotation and new apex domains as operators adapt

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub