Unit 42 analyzes the evolution of Gremlin stealer. This variant uses advanced obfuscation, crypto clipping and session hijacking to compromise data.

Unit42 is a cybersecurity research team known for its  analysis of cyber threats, malware, and cyber attack trends. Through research reports, threat intelligence briefings, and data analysis, Unit42 offers insights into emerging cyber threats and adversary tactics. Readers can learn about threat detection methodologies, vulnerability trends, and cyber attack attribution to enhance their cybersecurity posture and protect their organizations from advanced cyber threats.

Unit 42

Unit 42 researchers analyze the evolution of Gremlin Stealer, a .NET-based information stealer that has significantly upgraded its anti-analysis capabilities. The latest variant hides its payload in the .NET resource section using XOR encoding, employs identifier renaming, string encryption via a custom decoder function, and control-flow obfuscation. New capabilities include a Discord token extractor, a crypto clipper that replaces clipboard wallet addresses in real time, and a WebSocket-based session hijacking module that bypasses modern cookie protections. A separate sample was found packed with a commercial packing utility using instruction virtualization and a private virtual machine. IoCs including SHA256 hashes and C2 URLs are provided.

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files