SIG: ET MALWARE Possible Gremlin InfoStealer Data Upload

Rule Signatures
1

Packet shown in the referenced blog.

alert tcp $HOME_NET any → $EXTERNAL_NET $HTTP_PORTS (msg:“ET MALWARE Possible Gremlin InfoStealer Data Upload”; flow:established,to_server; content:“POST”; http_method; urilen:10; content:“/index.php”; http_uri; content:“filename=”; http_header; content:“.zip”; http_header; content:“PK”; http_client_body; depth:2; pcre:“/filename=\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}.zip/H”; classtype:trojan-activity; reference:url,Gremlin Stealer: New Stealer on Sale in Underground Forum; sid:155001; rev:1;)

Kind regards,
Kevin Ross

2 Likes
2

thanks for sharing @kevross33 ! I’ll get this in today and share the sid once it goes live.

Thanks,
Isaac

1 Like
3 
2061959 - ET MALWARE Gremlin Stealer CnC Exfil (POST)
2061960 - ET MALWARE Gremlin Stealer CnC Successful Exfil Confirmation
1 Like