Threat actors are constantly upgrading their malware to evade detection, and the latest variant of the Gremlin stealer demonstrates a significant leap in sophistication.
This evolving threat now uses a commercial packing utility that transforms its original code into custom bytecode, making it highly evasive.
Gremlin primarily targets compromised systems to siphon sensitive information, such as payment card details, browser cookies, cryptocurrency wallet data, and VPN credentials.
Once stolen, the malware bundles this data into a ZIP archive named after the victim’s public IP address and sends it to attacker-controlled servers.
Recently, threat intelligence identified a new exfiltration site at hxxp[:]194.87.92[.]109, which initially showed no detections on security platforms like VirusTotal.
Gremlin Hides Exfiltration Paths
To avoid detection by static analysis tools, malware authors have moved Gremlin’s malicious payload directly into the .NET Resource section.
By masking the payload with a single-byte XOR encoding routine, the resource section appears as an opaque block of data.
This successfully hides the hard-coded command-and-control (C2) URLs and exfiltration paths until they are decrypted during runtime.
Beyond hiding the payload, this variant employs several clever anti-analysis techniques to frustrate security researchers.
The authors use identifier renaming to strip away all meaningful context, replacing clear method names with random, short strings.
They also implement string encryption, working like a secret decoder ring: readable strings are stored as encrypted numbers and decrypted only when the program needs them.
Finally, control-flow obfuscation creates a maze of useless code paths, filling the decompiler output with complex, nonsensical statements that hide the true execution flow.
Because of these staged-loading mechanisms, critical functions are decrypted and mapped into memory only when necessary.
Gremlin stealer has transformed from a basic credential harvester into a highly modular toolkit capable of active financial interference.
The latest version includes a dedicated Discord token extraction module, signaling a shift toward targeting digital identities and communication platforms, paloalto networks said.
More alarmingly, the malware features a real-time crypto clipper that constantly monitors the system clipboard.
When it detects a cryptocurrency wallet pattern, it instantly replaces the victim’s address with the attacker’s address, diverting funds during live transactions.
The malware also boasts a new WebSocket-based session hijacking module that bypasses modern cookie protections by pulling data directly from active browser processes rather than relying on static database files.
Indicators of Compromise
| Indicator Type | Value | Description/Context |
|---|---|---|
| URL/Domain | hxxp[:]194.87.92[.]109 | Newly deployed exfiltration and data publication site used by the attacker. |
| SHA256 Hash | 2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b | Packed Gremlin stealer variant using a complex commercial utility. |
| SHA256 Hash | 9aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d614 | Gremlin stealer payload. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
