Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files Unit 42 analyzes the evolution of Gremlin stealer. This variant uses advanced obfuscation, crypto clipping and session hijacking to compromise data. The post Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files appeared first on Unit 42 . Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files Menu Tools ATOMs Security Consulting About Us Under…

https://unit42.paloaltonetworks.com/gremlin-stealer-evolution

sha256:8f0f50f4456cc7536dc58f39c9eabe8d9f13bc1ca8867cfd63b2915323dec0a6

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url2
ipv41
ipv60
sha10
domain6
sha25611
malware_token1
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
ip	194.87.92.109	Open →
domain	hf.cs	Open →
domain	bb.cs	Open →
domain	api.telegram.org	Open →
domain	wallet.dat	Open →
domain	api.ipify.org	Open →
domain

Malware families

Allowlist token matches only.

Agent Teslamalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports