Gremlin Stealer Adds Resource-Hidden Payloads and Live-Session Hijacking
Summary
Unit 42 compares Gremlin Stealer variants, detailing .NET resource and XOR payload concealment, virtualization and staged loading, plus theft of browser credentials, Discord tokens and clipboard data, crypto clipping, and live-session hijacking.
Key points
- Newer variants hide payloads in .NET resources with XOR encoding, then decrypt and map functions into memory as needed.
- A commercial packing utility transforms code into custom bytecode executed by a private virtual machine, complicating analysis.
- The stealer targets browser cookies and session tokens, clipboard contents, cryptocurrency wallets, FTP and VPN credentials, and payment card details.
- New modules extract Discord tokens and replace copied cryptocurrency wallet addresses with attacker-controlled ones.
- A WebSocket-based module requests data from running browser processes to hijack active sessions.
- The malware bundles harvested data into ZIP archives named with the victim’s public IP address and uploads them to an identified publishing site; VirusTotal showed zero detections for the site and related artifacts at discovery.
Article Details
- Attack Vectors
- Gremlin Stealer hides its payload in an embedded .NET resource and uses XOR encoding, encrypted strings, staged loading, and control-flow obfuscation to hinder analysis.
- The malware collects browser cookies, session tokens, clipboard data, cryptocurrency wallet information, FTP and VPN credentials, and payment card details.
- A crypto clipper monitors the clipboard and replaces detected cryptocurrency wallet addresses with an attacker-controlled address.
- A WebSocket-based module reportedly accesses data from running browser processes to hijack live sessions.
- Stolen data is bundled into ZIP archives named using the victim’s public IP address and uploaded to attacker-controlled infrastructure.
- Defensive Notes
- The article says Advanced WildFire models and analysis techniques were reviewed and updated based on the indicators shared in the research.
- The article says Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.
- The article recommends Cortex XDR protections for preventing malware execution, credential gathering, and detecting post-exploitation activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 194[.]87[.]92[.]109 | Identified in the article as the attacker-controlled backend hosting the Gremlin Stealer publishing site. |
| SHA256 | 1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5 | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | 2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | 281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2 | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | 691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3 | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | 971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f8759 | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | 9aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d614 | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | 9fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20 | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abd | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | ab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cd | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | d11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02c | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
| SHA256 | f76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346 | SHA-256 hash of a Gremlin Stealer sample analyzed in the article. |
MITRE ATT&CK
T1005 · Data from Local SystemGremlin Stealer collects local browser data, session tokens, clipboard contents, and stored credentials.T1027 · Obfuscated Files or InformationGremlin Stealer conceals its payload in an embedded .NET resource and masks it with XOR encoding.T1027.013 · Encrypted/Encoded FileThe malware encrypts strings and configuration data in an embedded resource and decodes them at runtime.T1027.016 · Junk Code InsertionA packed Gremlin variant transforms code into custom bytecode executed by a private virtual machine.T1041 · Exfiltration Over C2 ChannelThe malware uploads stolen data, bundled into ZIP archives, to attacker-controlled servers.T1115 · Clipboard DataThe crypto clipper monitors clipboard contents for cryptocurrency wallet strings and replaces matching addresses.
Malware
Vendors
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced Threat PreventionAdvanced Threat Prevention has an inbuilt machine learning-based detection that can detect exploits in real time.Advanced URL FilteringAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced WildFireThe Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the IoCs shared in this research.Cortex XDRCortex XDR and XSIAM are designed to: