blankgrabber | Built[.]exe

Resubmissions

04/11/2024, 15:14

241104-smhfja1hqb10

04/11/2024, 14:05

241104-rd3vfa1enk10

04/11/2024, 14:03

241104-rc586s1bjb10

Sharing

Copy URL Twitter E-mail

General

Target
Built.exe
Size 6.9MB
Sample241104-rd3vfa1enk
SHA256 772b29d83d6c4cd7b2f40f249a48e5ca6fb2ec2e3d0e0ba99fc5e40cf38bae5f
MD5 ad8ee72da097607430ec3e7693fe1a6b
SHA1 88000ffee497932a03ff0d9370f6558ffd01513c
SHA512 b35578fb1fa1a7bd471559f7f180463ee25b7ff4aafc5fe068def804b7bd058003359998650e78b6489c92f979e6cc92cbb47963b9dae0505f38e4b21071dbe4
SSDEEP 98304:PVpyDjWM8JEE1FUamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIy:Ly0neNTfm/pf+xk4dWRpmrbW3jmrQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blankgrabber

Malware Config

Signatures

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
static1/unpack001/�;��S��.pyc	blankgrabber

Blankgrabber family
blankgrabber

File Explorer

Built.exe

.exe 6.9MB
�;��S��.pyc

1KB

Built.exe

IMPHASH a06f302f71edd380da3d5bf4a6d94ebd
SHA256 772b29d83d6c4cd7b2f40f249a48e5ca6fb2ec2e3d0e0ba99fc5e40cf38bae5f
MD5 ad8ee72da097607430ec3e7693fe1a6b
SHA1 88000ffee497932a03ff0d9370f6558ffd01513c
SHA512 b35578fb1fa1a7bd471559f7f180463ee25b7ff4aafc5fe068def804b7bd058003359998650e78b6489c92f979e6cc92cbb47963b9dae0505f38e4b21071dbe4
SSDEEP 98304:PVpyDjWM8JEE1FUamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIy:Ly0neNTfm/pf+xk4dWRpmrbW3jmrQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

b9:e1:9b:68:93:b5:31:4a:a3:91:03:39:27:51:87:0d:f0:fc:1a:79:f5:2d:89:80:fd:9e:81:e3:0b:bc:4e:5d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Chains

Apr 25, 2023

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Serial Number

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 29, 2021 - Sep 28, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

49952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage ShutdownBlockReasonCreate GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW MsgWaitForMultipleObjects ShowWindow DestroyWindow CreateWindowExW RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW GetMessageW

kernel32

GetTimeZoneInformation GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW HeapSize RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler GetConsoleWindow K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte GetFileAttributesExW HeapReAlloc WriteConsoleW SetEndOfFile GetDriveTypeW IsDebuggerPresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableW

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Built.exe

PE Signature issue

user32

kernel32

advapi32

generic

�;��S��.pyc