blankgrabber | 1072efad667d604f609fd850a13e54507e23b5ad33b836436267144a4cbd28e2

Sharing

Copy URL Twitter E-mail

General

Target
Blank-Grabber-main.zip
Size 1.2MB
Sample260620-axe42sdx8x
SHA256 1072efad667d604f609fd850a13e54507e23b5ad33b836436267144a4cbd28e2
MD5 cf1622e33a46b0a9b7f88d0f031d679c
SHA1 6af28cb842e880d2121cc6f1ea9176c07d852bef
SHA512 d5768cab8a7c44f569dd9abbade6eb0a4cdce530e62e3b59ae19ddc7cab6782f2015c0b231568c9945c9fcb9e28ac8f7c4488d390416173c30a292f3e8b6dc57
SSDEEP 24576:OmyJ4KPprRsfyj7JHdGddG4VfvTbkrqAItD6b6D8J7kKy:grBrufyHJ9s04FMr8D8YZ
TLSH
T15A4533B046865893F3F994BAD18BDD0A200074DACEAD57F9B2B778CD0E4B418C597B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Blank-Grabber-main/Blank Grabber/Builder.bat
- Size 1KB
- SHA256 79e1377ac17e6aece067d4cf6a202d8baf43a9906cea353de7188c43b20500c8
- MD5 69f3538d09da509b93329b22fd59a956
- SHA1 d74ccc96102895e111712beedabcdc725fb23360
- SHA512 a5e2fdeb2d185acda43e6a0d964966fc5246d2fe598d094e0b59bd757c42170d3e4125cf7da736080a95141b453d12a53af295eb53bd64e431285e8213da9b07
- TLSH
  T13D118E252015B87E7720D70781D792A2B6FA80D353726599B0FB42DF0F5655478BB602
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Blank-Grabber-main/Blank Grabber/Components/BlankOBF.py
- Size 5KB
- SHA256 73bd45bbbf96aa84a2abf5eef93513126bd3adbbbb5ebd5272776643d99c1fb8
- MD5 b3d2f59792b99d98107717d6b7100cf3
- SHA1 5cf1f176236fb12fd665301a64be7d883ca125c8
- SHA512 1791b325ea86c56d35ff9c9216685dd7b3d0b0d01538de5cb6310cb64750daadbeccddbe51fc985bb22a8d8e67ab1a180708e7b97441e0daa2c0b1c14e918ed8
- SSDEEP 96:Fr54cd62hK9FFZ48PuCQYBX5oQL6oUMOQcL:FP6Us4B8JoQLBsQcL
- TLSH
  T13EC131728C622CF16F17CA0889AAC4274A7E9E6F520C5560F8FD63C55F24572C4FADE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Blank-Grabber-main/Blank Grabber/Components/loader.py
- Size 634B
- SHA256 e7dbfe873c719006f28e6526ef54215d7b7598bce5566734c552dab9f1f487e6
- MD5 ca35548638710a32f6d4bc1a61a103c5
- SHA1 2703967c4376cc2e0ca20191eff97b85989d8310
- SHA512 d1c0839326662b240dfa4bcea7284d261be46e9bb8b03f073e0328e361321f9cdfa740abd4541b2cdc21c806bcd901d3bc3cc36b9f7e0ee6191d189df0533061
- TLSH
  T157F0ACEAAC7248C486CFC2D57DB0E400CD691D0B8B00B720798D3AC5E740530D6F3090
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Blank-Grabber-main/Blank Grabber/Components/postprocess.py
- Size 2KB
- SHA256 72eefc2defd861c48721f235717a0f8de430ea8f2bc290b429cfbdc906ba539c
- MD5 bbed9f3d87c4927b2b2bc16a6ec4da51
- SHA1 c3bceb8a6fb5207abc75039e5a66afbf8324cd8f
- SHA512 352cd87d379e0a338d44f3933b6b135a36ebe83607157dfe28330ec2c03c6b2bcbbb2d43b1a06487675eea662c76084b3f9777f5b8d0c9132d50869318fc3c78
- TLSH
  T13C51FB04E8141954B7D2138ACC528EA01375F957A782182836ECA5C02F9983BA9FCFFC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Blank-Grabber-main/Blank Grabber/Components/process.py
- Size 8KB
- SHA256 72f2b7cbcc38b79ce96d12e6fdd9a45874728a1abd49eed00438069ba8006f21
- MD5 8cc1b499d73f3fc2140a5b0c97afd6f2
- SHA1 4e60e01f11ff8fec425c74679146e13713b18931
- SHA512 ac86a61d68bdac9b019d3c8a3f6102378b3e4f23be8398e6f0d79586dd29c0d104dc66e0cba267f88fb1b1d5241b74f51c073f2395f44d8f4ca34975b7534903
- SSDEEP 192:Eew1auOoI8I+IQI2Iz2Iym+IyIQICI0IiIgIcI6ISI+ISIKG2I0U0F+05dkIMN06:f4iE9pV3522EQTq1o4mE
- TLSH
  T19B02406550341C6AC3C6B2B4B98785A6733CBA47E40484703E6CB3EC5F36978EBE59C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Blank-Grabber-main/Blank Grabber/Components/rar.exe
- Size 615KB
- SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
- MD5 9c223575ae5b9544bc3d69ac6364f75e
- SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
- SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
- SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
- TLSH
  T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Blank-Grabber-main/Blank Grabber/Components/run.bat
- Size 1KB
- SHA256 ceade703cb46e78226dc0331ea37f3ed9f681b5969b56ddd15ca5a39e8c067d3
- MD5 5beaf38a2e57c2813f6b19b3fb08aca3
- SHA1 424b0ae28d3ea1e067e8c29d45f1f84040eaa7ec
- SHA512 7265b1a73f2d4841b62aec2f1eeb14114051f5b09fa47049ebb0a39ae220bdf35e747c98467aa56be8fc90aa7102888ce215edc88a52212b26ee915fdbe2d486
- TLSH
  T1032142952444A074A7D2C130ECD2D2FB255974874BB4AD58F1EF91F40F790CD92E07DA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Blank-Grabber-main/Blank Grabber/Components/stub.py
- Size 99KB
- SHA256 7602997372de338fbe45cb16f6bfe6d0c5bb57634ac7cf64e098a709c939d22c
- MD5 6dc9bbb14ef14c45d4d5d4128dbeb5ef
- SHA1 22b444a2d21707449ee8f5cde4cd87bbd63e255f
- SHA512 cff7bab1052443397a26aa28395d6cb139d2f270def1c0f811d2e92488e7a71daf460461cec8ea79a2f2fcaf3840b8827e9cf2c6f453fa715ff48e997eeabc3e
- SSDEEP 3072:G+RNbizH0U+ma2KJpUrRiwDL0a+P4HmrHnRn:VRNC+UrFq4Kn
- TLSH
  T1F2A3E826DD162922C3D7E3942A4695C33B1CED67470228307EEC52486F0DAB4D7F9AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Blank-Grabber-main/Blank Grabber/Components/upx.exe
- Size 525KB
- SHA256 a4240ea0e8a916d15f8391edef9705ab4de1f516dd360f0a336c5358686d434b
- MD5 8a98406e32ed6139bd9e75342d452948
- SHA1 ed77737b88a7351d0bc5f542ddb7ce84f8f95588
- SHA512 f5b17975560d97308a6ee66845225715e82bade9df7bc36821c76fe67fcf8d22929bf21b85e28dd11b7399d0109ab1f3786fd2010c2e5023d3a93d2bd5cf678b
- SSDEEP 12288:fOHsWPQsJdQmiR0eYG16fyP8RHzS75CaNgMYqIW7I2:2QmiWK16rRHzS7U6ip2
- TLSH
  T196B4230749296B6BF1B1C1740DFA59D224D4FCB6D299A45893F02E2934BA5BECFC2530
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  Blank-Grabber-main/Blank Grabber/Extras/unblock_sites.py
- Size 1KB
- SHA256 bf5c32f73990a16835b5b91f08647617dce973a68626ee4921bc5e2c5a07cafe
- MD5 0d1019573b112545f9fd41a4e0acc342
- SHA1 6ab1685e4d4aa3d16307325da3c8c6a65cc1cd2a
- SHA512 d4cdb37acabfe9013aa8cdec6cce9040a9d9c2b52570fa45f1a0750c29860b161d0446ded2d3f31c61676f42ab2be7c01c8cffc09ae64126510ee2d484e1c561
- TLSH
  T12C315432DC1B05F88362C4D4D54480461CB869A5C144ECF1BEECEA60FB87063EED1F99
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Blank-Grabber-main/Blank Grabber/gui.py
- Size 38KB
- SHA256 2541224e02dea793417cb301ee3de7097641b376df779041ff105cdf79692f1b
- MD5 d4516f5f779e1f422bb4fd3f204e1f2e
- SHA1 35c7d2e3ce191b9d67a149f378e249ae419acb43
- SHA512 704fda769a2cc70388f6ca77bde23506862e9e9fe170c8f5fc79b6ca63156f6fa6a55e9dfa763e4b7fb24ed0b5947a7b568b51a5ab167acace8a20c2b9cc396a
- SSDEEP 384:rRBBxtptPNbwhxFGbqWtYh6tr9f2L+vMPNPtLoPjW6CjLKabA117TDtOycaiC7a/:rRxRNbwhxFGbqWtBtoRvL7JwaMwY8
- TLSH
  T1EE0396A6C72C6A3E1973911DF5462C839D1CD9B3232E45623CFCA27822DC453D2E6E99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22