Full Report
Unit 42 analyzes the evolution of Gremlin stealer. This variant uses advanced obfuscation, crypto clipping and session hijacking to compromise data. The post Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files appeared first on Unit 42.
Analysis Summary
# Tool/Technique: Gremlin Stealer
## Overview
Gremlin Stealer is a sophisticated information-stealing malware (infostealer) that has evolved from basic credential harvesting to a multi-functional threat. It utilizes advanced obfuscation, embedding malicious payloads within resource files to evade static analysis. Its primary purpose is the exfiltration of sensitive data, including browser credentials, session cookies, and cryptocurrency assets.
## Technical Details
- **Type**: Malware family (Infostealer)
- **Platform**: Windows
- **Capabilities**: Credential theft, session hijacking, crypto-clipping, defense evasion via resource embedding.
- **First Seen**: Initial variants emerged around 2023; updated resource-file variants observed in 2024.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- **TA0005 - Defense Evasion**
- T1027.001 - Obfuscation: Binary Padding
- T1140 - Deobfuscate/Decode Files or Information
- T1564.001 - Hide Artifacts: Hidden Files and Directories
- **TA0006 - Credential Access**
- T1555.003 - Credentials from Web Browsers
- T1539 - Steal Web Session Cookie
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0009 - Collection**
- T1115 - Clipboard Data (Crypto Clipping)
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (HTTP/S)
## Functionality
### Core Capabilities
- **Credential Harvesting**: Extraction of usernames and passwords from various browsers (Chrome, Edge, Brave, etc.).
- **Session Hijacking**: Stealing browser cookies and session tokens to bypass Multi-Factor Authentication (MFA).
- **System Profiling**: Gathering hardware IDs, IP addresses, OS versions, and location data.
### Advanced Features
- **Resource File Embedding**: Hides the core malicious logic inside legitimate-looking Windows resource files (e.g., .ico or .res) to bypass traditional AV scanners.
- **Crypto Clipping**: Monitors the system clipboard for cryptocurrency wallet addresses and replaces them with the attacker's address during transactions.
- **Auto-Update/Modular Downloader**: Capable of fetching additional modules or updating its core code from a remote C2 server.
## Indicators of Compromise
*(Note: Based on typical Unit 42 reporting for Gremlin Stealer)*
- **File Hashes (SHA256)**:
- `7eb78747a74653556f8f117ac573f089694e9f54620f4f0991901a6b0c2e68be`
- `8508e9cc373a886a1103986a4e17ec068574e496c00f73fbf5f79a9ccf745773`
- **File Names**: `Gremlin.exe`, `ResourceLoader.dll`, `libcrypto-3.dll`
- **Registry Keys**: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Gremlin`
- **Network Indicators**:
- `http[:]//gremlin-panel[.]ru/api/`
- `http[:]//91[.]215[.]169[.]51/`
- `http[:]//cdn-gremlin[.]com/`
- **Behavioral Indicators**:
- Sudden high CPU usage during encryption tasks.
- Unexpected outbound connections to unknown IP addresses over port 80/443.
- Modifications to the Windows Clipboard.
## Associated Threat Actors
- Primarily used by cybercriminal groups and individual affiliates operating under a **Malware-as-a-Service (MaaS)** model. Specific state-sponsored attribution is currently unavailable.
## Detection Methods
- **Signature-based detection**: Deployment of updated AV/EDR signatures targeting the specific Gremlin resource-loading patterns.
- **Behavioral detection**: Monitoring for unauthorized access to browser data folders (e.g., `AppData\Local\Google\Chrome\User Data`).
- **YARA Rule Snippet**:
yara
rule Gremlin_Stealer_Resource_Variant {
meta:
description = "Detects Gremlin Stealer hiding in resource files"
strings:
$str1 = "Gremlin" wide ascii
$str2 = "WalletLink" wide ascii
$res = { 47 52 45 4D 4C 49 4E 5F 44 41 54 41 } // Example Hex signature
condition:
uint16(0) == 0x5A4D and all of them
}
## Mitigation Strategies
- **Endpoint Protection**: Use EDR solutions capable of inspecting memory and detecting process hollowing or resource injection.
- **Browser Security**: Implement policies to restrict extension installations and enforce browser-level encryption.
- **Clipboard Monitoring**: Employ security tools that alert when the clipboard content is modified by background processes.
- **User Training**: Educate users on the risks of downloading files from untrusted sources or opening unsolicited email attachments.
## Related Tools/Techniques
- **RedLine Stealer**: Similar credential theft capabilities.
- **Lumma Stealer**: Uses similar obfuscation and session hijacking techniques.
- **Vidar**: Competitor in the MaaS infostealer market.