blankgrabber | Built[.]exe

Resubmissions

11/11/2024, 19:58

241111-ypvrjatqcs10

11/11/2024, 19:43

241111-yfh2datnct10

Sharing

Copy URL Twitter E-mail

General

Target
Built.exe
Size 6.9MB
Sample241111-yfh2datnct
SHA256 7587eac01bef8b164d2b7847b2f11f976cb9d66a1561f2be5258ec4a3562f390
MD5 d98124962180ae791e01b8c65bb0d58b
SHA1 3416cb7734b4021950a6e24899207a7604eb63d8
SHA512 de3adeabbe87a93dbd6fb3e1e149122fa2b3ab583a0fa24bb548b96f18774e8eabf2dc844a9f4fb170b22d2ea229bb47e2ed2864d4a0d9bb1cdabc454bda4068
SSDEEP 98304:wvDjWM8JEE1FwHcamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIu:wv02eNTfm/pf+xk4dWRpmrbW3jmrE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blankgrabber

Malware Config

Signatures

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
static1/unpack001/_�Ϣ��=.pyc	blankgrabber

Blankgrabber family
blankgrabber

File Explorer

Built.exe

.exe 6.9MB
_�Ϣ��=.pyc

1KB

Built.exe

IMPHASH 72c4e339b7af8ab1ed2eb3821c98713a
SHA256 7587eac01bef8b164d2b7847b2f11f976cb9d66a1561f2be5258ec4a3562f390
MD5 d98124962180ae791e01b8c65bb0d58b
SHA1 3416cb7734b4021950a6e24899207a7604eb63d8
SHA512 de3adeabbe87a93dbd6fb3e1e149122fa2b3ab583a0fa24bb548b96f18774e8eabf2dc844a9f4fb170b22d2ea229bb47e2ed2864d4a0d9bb1cdabc454bda4068
SSDEEP 98304:wvDjWM8JEE1FwHcamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIu:wv02eNTfm/pf+xk4dWRpmrbW3jmrE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

5a:c6:78:71:fe:f9:ce:aa:5e:56:c2:8b:55:73:23:e0:27:b8:cc:eb:af:c2:eb:27:c6:20:ed:27:94:69:1a:83

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Chains

Apr 25, 2023

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Serial Number

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 29, 2021 - Sep 28, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

52656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW LCMapStringW CompareStringW FlsFree GetOEMCP GetCPInfo GetModuleHandleW MulDiv FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress GetEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsSetValue FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Built.exe

PE Signature issue

user32

comctl32

kernel32

advapi32

gdi32

generic

_�Ϣ��=.pyc