Conflicting Malware Attribution: Hannibal vs Gremlin Stealer

By /

Listen to this Post

Featured Image
During malware research, conflicting attributions were discovered for the same malware samples:
– CyFirma identifies it as Hannibal Stealer (a rebrand of SHARP/TX lineage).
– Palo Alto Unit42 and InfoSecurity Magazine label it as Gremlin Stealer.

Sample Hashes:

  • Hannibal (CyFirma):
    – `251d313029b900f1060b5aef7914cc258f937b7b4de9aa6c83b1d6c02b36863e`
    – `f69330c83662ef3dd691f730cc05d9c4439666ef363531417901a86e7c4d31c8`
  • Gremlin (Unit42):
    – `d1ea7576611623c6a4ad1990ffed562e8981a3aa209717065eddc5be37a76132`

This inconsistency highlights challenges in malware detection due to varying vendor naming conventions.

You Should Know:

1. YARA Rule for Detection

Since both stealers share code similarities, a unified detection rule can be applied: 

rule Hannibal_Gremlin_Stealer {
meta:
description = "Detects Hannibal/Gremlin Stealer variants"
author = "Your_Name"
date = "2024-05-09"
strings:
$s1 = "SharpLoader" nocase
$s2 = "TX_Stealer" nocase
$s3 = "GremlinPayload" nocase
$s4 = { 6A 00 68 00 00 00 00 6A 00 6A 00 6A 00 6A 00 68 }
condition:
3 of ($s)
}

2. Behavioral Indicators (IOCs)

  • File System Changes: 
    Monitor for suspicious file drops in %AppData% or /tmp 
find /tmp -type f -name ".exe" -mtime -1
  • Network Traffic: 
    Check for C2 connections 
tcpdump -i eth0 'dst port 443 and (host 1.2.3.4 or host 5.6.7.8)'
  • Process Injection: 
    Detect suspicious process hollowing 
Get-Process | Where-Object { $_.Modules.ModuleName -like "unknown" }

3. Sigma Rule for SIEM Detection

title: Gremlin/Hannibal Stealer Activity 
description: Detects execution patterns of Gremlin/Hannibal Stealer 
author: Your_Name 
logsource: 
product: windows 
service: sysmon 
detection: 
selection: 
EventID: 1 
CommandLine: 
- "SharpLoader" 
- "TX_Stealer" 
condition: selection 
level: high

4. Mitigation Steps

  • Block IOCs at Firewall: 
    iptables -A INPUT -s 1.2.3.4 -j DROP
  • Scan for Compromise: 
    clamscan -r --infected /home
  • Memory Analysis with Volatility: 
    volatility -f memory.dump --profile=Win10x64 malfind

What Undercode Say

The malware landscape is plagued by inconsistent naming, making threat intelligence sharing difficult. Security teams must:
– Prioritize behavioral analysis over family names.
– Use multi-vendor IOCs to avoid blind spots.
– Automate detection with YARA/Sigma rules.

Linux Commands for Threat Hunters:

 Check for suspicious cron jobs 
crontab -l 
 Analyze network connections 
ss -tulnp 
 Search for hidden files 
find / -name "." -type f -exec ls -la {} \;

Windows Commands for Incident Response:

 List autorun persistence 
wmic startup get caption,command 
 Check for unusual services 
Get-Service | Where-Object { $_.Status -eq "Running" }

Expected Output:

A unified detection approach combining YARA rules, behavioral IOCs, and automated SIEM alerts ensures accurate identification regardless of vendor naming discrepancies.

Prediction

Malware rebranding will increase, requiring more robust detection frameworks beyond static naming conventions. AI-driven attribution may emerge to reduce analyst bias.

References:

Reported By: Apophis133 Cyfirma – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: