https://github.com/lowlevel01/degremlin

Decrypt and Patch strings obfuscated with Appfuscator. Tested on Gremlin Stealer.
https://github.com/lowlevel01/degremlin

appfuscator deobfuscator gremlin-stealer

Last synced: 11 months ago
JSON representation

Decrypt and Patch strings obfuscated with Appfuscator. Tested on Gremlin Stealer.

• Host: GitHub
• URL: https://github.com/lowlevel01/degremlin
• Owner: lowlevel01
• Created: 2025-07-02T14:36:28.000Z (about 1 year ago)
• Default Branch: main
• Last Pushed: 2025-07-02T15:43:11.000Z (about 1 year ago)
• Last Synced: 2025-07-02T15:45:13.137Z (about 1 year ago)
• Topics: appfuscator, deobfuscator, gremlin-stealer
• Language: C#
• Homepage:
• Size: 3.21 MB
• Stars: 0
• Watchers: 0
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

          
# deGremlin

##### A tool to decrypt and patch strings obfuscated with Appfuscator. Tested on Gremlin Stealer.



# USAGE

````

       __          ______                              __    _

      |  ]       .' ___  |                            [  |  (_)

  .--.| | .---. / .'   \_| _ .--.  .---.  _ .--..--.   | |  __   _ .--.

/ /'`\' |/ /__\\| |   ____[ `/'`\]/ /__\\[ `.-. .-. |  | | [  | [ `.-. |

| \__/  || \__.,\ `.___]  || |    | \__., | | | | | |  | |  | |  | | | |

 '.__.;__]'.__.' `._____.'[___]    '.__.'[___||__||__][___][___][___||__]

                                                                        P.S: little bit Appfuscator

Usage:

degremlin.exe [filepath] [method_token_in_hex]

````

# Example

##### This is from the Gremlin Stealer sample

![](images/before_after.png)

# IT DOES

- [x] Patch most obfuscated strings

- [x] Simplify Addition and XOR mixed boolean arithmetic

- [x] Eliminate sizeof's

- [x] Eliminate EmptyType

# TO-DO

- [ ] Patch terneary operator

- [ ] Cover more patterns