# SIG: ET MALWARE Possible Gremlin InfoStealer Data Upload

**URL:** <https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680>\
**Category:** Rule Signatures\
**Created:** [April 29, 2025, 10:46am UTC](https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680 "2025-04-29T10:46:27Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [April 29, 2025, 10:46am UTC](https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680/1 "2025-04-29T10:46:27Z")

</div>

Packet shown in the referenced blog.

alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“ET MALWARE Possible Gremlin InfoStealer Data Upload”; flow:established,to\_server; content:“POST”; http\_method; urilen:10; content:“/index.php”; http\_uri; content:“filename=”; http\_header; content:“.zip”; http\_header; content:“PK”; http\_client\_body; depth:2; pcre:“/filename=\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}.zip/H”; classtype:trojan-activity; reference:url,[Gremlin Stealer: New Stealer on Sale in Underground Forum](http://unit42.paloaltonetworks.com/new-malware-gremlin-stealer-for-sale-on-telegram/); sid:155001; rev:1;)

Kind regards,  
Kevin Ross

---

_[View the full topic](https://community.emergingthreats.net/t/sig-et-malware-possible-gremlin-infostealer-data-upload/2680)._