Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

This report details the evolving tactics of the Gremlin stealer malware, specifically a recent variant employing sophisticated obfuscation techniques to evade detection. The malware, which targets sensitive data like payment card details and cryptocurrency wallets, utilizes instruction virtualization and .NET resource section packing to hide its malicious payload and evade traditional analysis methods. The threat actors behind this variant are increasingly focused on active financial fraud and session hijacking, demonstrating a significant evolution in the malware's capabilities.