Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

What Happened

Gremlin stealer is a malicious program that steals sensitive information like passwords, cookies, and cryptocurrency details from infected computers. Recently, its creators have upgraded it to be much stealthier, hiding its core functions to avoid detection by antivirus software. This matters because the new version can actively steal cryptocurrency by altering copied wallet addresses and can hijack active web sessions. Organizations should ensure their security software is updated to detect behavioral anomalies and block the known malicious web addresses associated with this threat.

Key Takeaways

• Gremlin stealer has evolved into a modular toolkit featuring Discord token extraction and active financial fraud via a crypto clipper.
• The malware employs advanced obfuscation, hiding its payload within the .NET Resource section using XOR encoding to evade static analysis.
• Recent variants utilize a commercial packing utility (Themida) and implement identifier renaming, string encryption, and control-flow obfuscation.
• A new WebSocket-based session hijacking module allows the stealer to bypass modern cookie protections by querying live browser processes.

Affected Systems

• Windows
• Chromium-based browsers
• Discord
• Cryptocurrency wallets

Attack Chain

Gremlin stealer executes on the victim's machine, utilizing a commercial packer (Themida) and control-flow obfuscation to evade initial detection. It dynamically decrypts and loads its core modules from the .NET resource section using a single-byte XOR key. Once active, the malware harvests browser cookies, Discord tokens, and monitors the clipboard to swap cryptocurrency wallet addresses. The stolen data is compressed into a ZIP archive named after the victim's IP address and exfiltrated to an attacker-controlled server or via the Telegram Bot API.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article does not provide specific detection rules or queries.

Detection Engineering Assessment

EDR Visibility: Medium — Heavy obfuscation and memory-only loading of modules bypass many static signatures, but behavioral actions like clipboard monitoring and browser process access are highly visible to EDR. Network Visibility: Medium — Exfiltration occurs over standard HTTP/HTTPS to dedicated IPs or abused legitimate APIs (Telegram), which can blend with normal traffic if not decrypted or specifically monitored. Detection Difficulty: Moderate — Static analysis is difficult due to Themida packing and XOR-encoded resources, requiring dynamic analysis or behavioral detection to identify the threat.

Required Log Sources

• Process Creation (Event ID 4688 / Sysmon 1)
• Network Connections (Sysmon 3)
• File Creation (Sysmon 11)

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for unknown or untrusted processes frequently reading the system clipboard, which may indicate crypto clipper activity.	EDR API monitoring / OS API logs	Collection	Medium
Monitor for unusual processes accessing Chromium browser data directories or initiating WebSocket connections to local browser debugging ports.	File Access Logs / Network Connections	Credential Access	Low
Hunt for .NET executables making outbound network connections to the Telegram Bot API (api.telegram.org) without a legitimate business justification.	Network Connections / DNS Logs	Exfiltration	Medium

Control Gaps

• Static AV signatures may fail to detect payloads hidden within XOR-encoded .NET resource sections.

Key Behavioral Indicators

• Processes rapidly accessing clipboard data
• Unexpected WebSocket connections to browser processes
• Creation of ZIP files named as IP addresses in temporary directories

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• Consider blocking the identified C2 IP address and URL at the perimeter firewall or web proxy.

Infrastructure Hardening

• Evaluate implementing DNS filtering to block newly registered or untrusted domains.
• Consider restricting outbound access to the Telegram API if it is not required for business operations.

User Protection

• Ensure EDR solutions are configured to monitor for credential access behaviors, particularly targeting browser data stores.
• If supported by your EDR, consider enabling behavioral protections against clipboard hijacking.

Security Awareness

• Educate users on the risks of downloading unverified software, which is a common vector for infostealers.

MITRE ATT&CK Mapping

• T1027 - Obfuscated Files or Information
• T1027.002 - Software Packing
• T1115 - Clipboard Data
• T1539 - Steal Web Session Cookie
• T1552.001 - Credentials In Files
• T1041 - Exfiltration Over C2 Channel

Additional IOCs

• File Hashes:
  • 9aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d614 (sha256) - Gremlin stealer sample
  • 971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f8759 (sha256) - Gremlin stealer sample
  • ab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cd (sha256) - Gremlin stealer sample
  • f76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346 (sha256) - Gremlin stealer sample
  • a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abd (sha256) - Gremlin stealer sample
  • 691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3 (sha256) - Gremlin stealer sample
  • 281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2 (sha256) - Gremlin stealer sample
  • 9fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20 (sha256) - Gremlin stealer sample
  • d11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02c (sha256) - Gremlin stealer sample
  • 1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5 (sha256) - Gremlin stealer sample