Gremlin Stealer Uses Encrypted Resources to Store Exfiltration Paths

The report describes a new, highly obfuscated Gremlin stealer variant that uses commercial packing to convert code into custom bytecode and hides payloads in .NET resources with XOR encoding; it employs identifier renaming, string encryption, control-flow obfuscation and staged decryption, and includes modules for Discord token theft, a real-time cryptocurrency clipboard clipper, and WebSocket-based session hijacking. The authors publish exfiltrated data to an attacker-controlled site (http:194.87.92.109) and the report provides two SHA256 hashes as indicators of compromise.