Gremlin Stealer Hides C2 URLs and Paths in Encrypted Sections

Key Takeaways

• A new, highly obfuscated variant of the Gremlin stealer malware has been discovered.
• This variant hides its command-and-control (C2) server URLs and exfiltration paths within encrypted .NET resource sections.
• The malware employs multiple layers of anti-analysis techniques, including identifier renaming, string encryption, and control-flow obfuscation, making static detection and reverse engineering significantly more challenging.
• It targets a wide array of sensitive data, including browser credentials, cryptocurrency wallets, Discord tokens, and leverages a clipboard hijacker for real-time fund diversion.

Evolved Gremlin Stealer Hides Infrastructure in Encrypted Sections, Evading Detection

Cybersecurity researchers have identified a sophisticated new iteration of the Gremlin stealer malware, which now employs advanced obfuscation techniques to conceal its command-and-control (C2) infrastructure and evade detection. This updated variant significantly complicates traditional static analysis, posing a greater threat to organizations and individual users.

The Gremlin stealer, initially observed on underground forums as a readily available tool for credential theft, has historically targeted web browsers, clipboard contents, and local storage. Its objectives include extracting payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP and VPN credentials. Once gathered, this sensitive information is compressed into a ZIP archive, named after the victim’s public IP address, and covertly uploaded to an attacker-controlled web panel for subsequent access or sale.

Analysts at Unit 42, the threat intelligence arm of Palo Alto Networks, reported the discovery of this new Gremlin variant. Their investigation revealed it was actively exfiltrating stolen data to a previously unflagged server located at hxxp[:]194.87.92[.]109. This lack of prior detection by security vendors on VirusTotal underscores the stealth capabilities of the new infrastructure.

The evolution of Gremlin is stark. Earlier versions of the malware lacked any significant obfuscation, leaving function names and class labels plainly visible. The latest builds, however, demonstrate a deliberate shift towards enhanced stealth, incorporating multiple anti-analysis measures designed to frustrate both automated security tools and human researchers alike.

Beyond its improved evasion tactics, the new variant has also expanded its data collection capabilities. In addition to standard browser and crypto wallet targeting, it now features a dedicated module for stealing Discord tokens, granting attackers unauthorized access to victims’ online accounts. Furthermore, a new clipboard hijacker module has been integrated, which surreptitiously replaces any copied cryptocurrency wallet address with one belonging to the attacker, enabling real-time diversion of funds.

Gremlin Stealer Stores C2 URLs and Exfiltration Paths in Encrypted Resource Sections

A critical technical advancement in this Gremlin variant is the method used to store its core configuration. Instead of embedding C2 URLs as easily readable strings within the code, the malware now encrypts this data using XOR encoding and stores it within the .NET resource section. This technique renders the resource block as indecipherable raw data to static analysis tools.

Researchers were able to uncover the plaintext configuration, including hard-coded server addresses and upload paths, by applying a simple single-byte XOR decryption routine. This strategy is not unique to Gremlin, mirroring tactics employed by other prominent malware families such as Agent Tesla, GuLoader, LokiBot, and Quasar RAT, which also leverage resource sections to conceal their payloads.

The current Gremlin variant also implements a staged loading mechanism, where individual functions are only decrypted and loaded into memory as they are needed. This approach necessitates the use of dynamic analysis and live debugging tools to observe the malware’s true operational behavior, as static reviews yield little meaningful information.

Deep Code Obfuscation Blocks Reverse Engineering

Beyond concealing C2 data, this Gremlin variant employs three distinct layers of obfuscation to impede analysis and reverse engineering efforts:

1. Identifier Renaming: All classes, methods, and variables are renamed to short, meaningless labels (e.g., “a”, “b”, “hf”, “bb”). This eliminates contextual clues that would typically assist researchers in understanding a function’s purpose.
2. String Encryption: Instead of embedding readable strings like “password” or server addresses directly in the code, all strings are encrypted and decrypted at runtime using an internal function. This prevents analysts from finding relevant keywords such as “Telegram” or “wallet.dat” through static analysis.



3. Control-Flow Obfuscation: The decompiled code is deliberately flooded with spurious branches, irrelevant loops, and illogical “goto” jumps. While the underlying logic might be straightforward, this noise makes the code appear excessively complex and difficult to follow.

Given these sophisticated anti-analysis measures, organizations are strongly advised to prioritize behavioral detection tools over reliance on signature-based scanning, as this malware is specifically designed to circumvent static analysis.

What You Should Do

• Implement and maintain robust endpoint detection and response (EDR) solutions capable of behavioral analysis, not just signature-based detection.
• Regularly update all operating systems, applications, and security software to patch known vulnerabilities that malware like Gremlin might exploit.
• Educate users about phishing and social engineering tactics, as these are common initial infection vectors for stealer malware.
• Enforce multi-factor authentication (MFA) on all critical accounts, especially for email, cloud services, and cryptocurrency platforms, to mitigate the impact of stolen credentials.
• Monitor network traffic for anomalous connections to known or suspected C2 infrastructure, including the IP hxxp[:]194.87.92[.]109.
• Conduct regular backups of critical data and store them securely offline to enable recovery in case of data exfiltration or compromise.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.