blankgrabber | a5851f86927ab2cb26b54e12bc27e41e1348617140e026af00ddc574f76d9bcb

General

Target
2026-04-23_3546bbcc5980f97f549eb93bbd824d19_blankgrabber_coinminer_icedid_luca-stealer_njrat
Size 8.1MB
Sample260423-ql8j8aex2z
SHA256 a5851f86927ab2cb26b54e12bc27e41e1348617140e026af00ddc574f76d9bcb
MD5 3546bbcc5980f97f549eb93bbd824d19
SHA1 24be74172a158a5210c5a67047a76b5e4d8de177
SHA512 b6b31f0bc9c0f75dcac394a754e4504f8c6acb4540c590a8565078b5ee19c853a3b507f0b7c1af38526348ff606631f4533fd1735014e02e0ea90e8d050c5813
SSDEEP 196608:FrelyVLXO3Rs3AklKMB1akvcErhJJ06G+dQJja0X6rv8BLG:h4yZXOBjrMBXvcErhY61qJu0QMi
TLSH
T1F1863366A2E195E5CC77C47C5091072BF7B0FC2843259AEB1784C2D9DE26AC21F39B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-23_3546bbcc5980f97f549eb93bbd824d19_blankgrabber_coinminer_icedid_luca-stealer_njrat
- Size 8.1MB
- SHA256 a5851f86927ab2cb26b54e12bc27e41e1348617140e026af00ddc574f76d9bcb
- MD5 3546bbcc5980f97f549eb93bbd824d19
- SHA1 24be74172a158a5210c5a67047a76b5e4d8de177
- SHA512 b6b31f0bc9c0f75dcac394a754e4504f8c6acb4540c590a8565078b5ee19c853a3b507f0b7c1af38526348ff606631f4533fd1735014e02e0ea90e8d050c5813
- SSDEEP 196608:FrelyVLXO3Rs3AklKMB1akvcErhJJ06G+dQJja0X6rv8BLG:h4yZXOBjrMBXvcErhY61qJu0QMi
- TLSH
  T1F1863366A2E195E5CC77C47C5091072BF7B0FC2843259AEB1784C2D9DE26AC21F39B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion blankgrabber spyware stealer
- A stealer written in Python and packaged with Pyinstaller
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  Detects executables using Telegram Chat Bot
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2