Gremlin Stealer

Beyond hiding C2 data in resources, this variant uses three distinct obfuscation layers to slow down analysis. The first is identifier renaming... The second layer is string encryption... The third layer is control-flow obfuscation...

We uncovered an iteration of Gremlin stealer ( SHA256 2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b ) packed using a packing utility.

The file’s reported creation date — 2041-06-29 19:48:00 UTC — is set in the future. This is a common anti-analysis technique used by malware authors to bypass certain detection mechanisms or confuse automated analysis pipelines.

When researchers applied a single-byte XOR decryption routine, they recovered the plaintext configuration including hard-coded server addresses and upload paths.

Gremlin Stealer is an evolving infostealer malware that uses advanced obfuscation techniques, including embedded resource concealment and commercial packers with instruction virtualization, to evade detection and analysis.

The current variant also uses a staged loading approach, meaning each function is only decrypted and placed into memory when needed.

This crypto clipper functionality continuously monitors the system clipboard for strings matching cryptocurrency wallet patterns. When it detects a match, the malware replaces the victim's address with the attacker’s wallet in real time

Gremlin stealer includes a dedicated Discord token extraction module

The first feature advertised for Gremlin Stealer is that it bypasses Chrome’s cookie v20 protection... demonstrates how it bypasses Chrome's cookie V20 protection and obtains cookie-related information.

Gremlin Stealer checks for cookies and saved passwords from an extensive list of Chromium- and Gecko-based browsers and writes them into a file to be exfiltrated later.

Stealing functionality targets the following: Popular browsers (e.g., cookies, passwords, cards, forms)

Gremlin Stealer creates a text file that contains system information (e.g., PC username, clipboard data, processor information and hardware ID)

Gremlin Stealer is an evolving infostealer malware that uses advanced obfuscation techniques, including embedded resource concealment and commercial packers with instruction virtualization, to evade detection and analysis.

This information-stealing malware exfiltrates data from its victims and uploads this information to its web server for publication.

This crypto clipper functionality continuously monitors the system clipboard for strings matching cryptocurrency wallet patterns. When it detects a match, the malware replaces the victim's address with the attacker’s wallet in real time

Stealer functions Basic features include... Screenshots

It can capture data from browsers, the clipboard and the local disk to steal sensitive data

The WebSocket-based session hijacking module represents its most significant technical upgrade. This allows Gremlin stealer to hijack active, live browser sessions and bypass modern cookie protections by requesting the data directly from the running browser process.

These texts are gathered into a ZIP archive, which is sent to its server through the URL hxxp[:]//207.244.199[.]46/index.php

The most significant technical change is where the malware stores its core configuration. Rather than embedding C2 URLs as readable strings, the authors have moved that data into the .NET resource section, scrambled with XOR encoding.

Figure 19 shows a TCP stream of an HTTP POST request that Gremlin Stealer makes when sending stolen information to its server.

This variant exfiltrates stolen data to a newly deployed site at hxxp[:]194.87.92[.]109

The authors of the website describe these files as ZIP archives of stolen data from victims' machines, with options to delete or download the archives.

Figure 19 shows a TCP stream of an HTTP POST request that Gremlin Stealer makes when sending stolen information to its server. It sends the information as a ZIP archive

It uploads the stolen data to the server using a hard-coded Telegram API key.