# SIG: ET MALWARE Possible Gremlin InfoStealer Data Upload

**URL:** <https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680>\
**Category:** Rule Signatures\
**Created:** [April 29, 2025, 10:46am UTC](https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680 "2025-04-29T10:46:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [April 29, 2025, 10:46am UTC](https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680/1 "2025-04-29T10:46:27Z")

</div>

Packet shown in the referenced blog.

alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“ET MALWARE Possible Gremlin InfoStealer Data Upload”; flow:established,to\_server; content:“POST”; http\_method; urilen:10; content:“/index.php”; http\_uri; content:“filename=”; http\_header; content:“.zip”; http\_header; content:“PK”; http\_client\_body; depth:2; pcre:“/filename=\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}.zip/H”; classtype:trojan-activity; reference:url,[Gremlin Stealer: New Stealer on Sale in Underground Forum](http://unit42.paloaltonetworks.com/new-malware-gremlin-stealer-for-sale-on-telegram/); sid:155001; rev:1;)

Kind regards,  
Kevin Ross

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [April 29, 2025, 4:11pm UTC](https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680/2 "2025-04-29T16:11:43Z")

</div>

thanks for sharing @kevross33 ! I’ll get this in today and share the sid once it goes live.

Thanks,  
Isaac

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [April 29, 2025, 8:57pm UTC](https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680/3 "2025-04-29T20:57:45Z")

</div>

```auto
2061959 - ET MALWARE Gremlin Stealer CnC Exfil (POST)
2061960 - ET MALWARE Gremlin Stealer CnC Successful Exfil Confirmation

```