blankgrabber | loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 11.4MB
Sample260623-pdbd3scv9k
SHA256 d25c2e6f6efa788da31393d2fd0bbe25dd9fb0ff8414115c020971df71efd3ab
MD5 6e0966ab703a05ce406d9a34a67c8519
SHA1 e9f53c7dc45ccdbf4b39a2ec7ed58285401ed5e6
SHA512 fe8f30a47608d9bda15d3a6be969ddf498ceed83aabe9fbe32f30cc27d7cf1d14e00020a44bf3b07645f25f6e2bced2136f1ae100e6de4d5691acc740079373e
SSDEEP 196608:aDT02Yo5BvHQKwNt7QE4Q/MWHF6nkn7wR6DOYjJlpZstQoS9Hf12VKXnKgvCWV5p:av1Y4wNt7+wMWdn7bBpGt7G/MPgPr
TLSH
T18DC63393B27560ADD1F6C2785EC36D64BC7ABC6C1E08457FD4804F314EA9C68EA0DA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer blankgrabber

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 2 IoCs

resource	yara_rule
sample	blankgrabber_exe
static1/unpack001/*k�+ ƻ.pyc	blankgrabber_exe

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
loader.exe

File Explorer

loader.exe

.exe 11.4MB
*k�+ ƻ.pyc

857B

loader.exe

IMPHASH b01917dcfd1cd8095891a3f077d3bbfe
SHA256 d25c2e6f6efa788da31393d2fd0bbe25dd9fb0ff8414115c020971df71efd3ab
MD5 6e0966ab703a05ce406d9a34a67c8519
SHA1 e9f53c7dc45ccdbf4b39a2ec7ed58285401ed5e6
SHA512 fe8f30a47608d9bda15d3a6be969ddf498ceed83aabe9fbe32f30cc27d7cf1d14e00020a44bf3b07645f25f6e2bced2136f1ae100e6de4d5691acc740079373e
SSDEEP 196608:aDT02Yo5BvHQKwNt7QE4Q/MWHF6nkn7wR6DOYjJlpZstQoS9Hf12VKXnKgvCWV5p:av1Y4wNt7+wMWdn7bBpGt7G/MPgPr
TLSH
T18DC63393B27560ADD1F6C2785EC36D64BC7ABC6C1E08457FD4804F314EA9C68EA0DA8D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

A stealer written in Python and packaged with Pyinstaller
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8a:ee:79:94:5b:eb:a7:19:46:06:4d:9e:02:4f:e4:3f:9b:24:08:77:af:7b:79:e6:3c:47:95:fa:86:42:95:c1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Chains

Apr 25, 2023

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Serial Number

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 29, 2021 - Sep 28, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken

comctl32

LoadIconMetric

gdi32

CreateFontIndirectW DeleteObject SelectObject

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateProcessW CreateSymbolicLinkW DeleteCriticalSection DeleteFileW EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetCPInfo GetCommandLineW GetCurrentProcess GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetFinalPathNameByHandleW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoW GetTempPathW InitializeCriticalSection K32EnumProcessModules K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MulDiv MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RemoveDirectoryW SetConsoleCtrlHandler SetDllDirectoryW SetErrorMode SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte __C_specific_handler

api-ms-win-crt-convert-l1-1-0

mbstowcs strtol strtoul

api-ms-win-crt-environment-l1-1-0

__p__wenviron _wputenv_s

api-ms-win-crt-filesystem-l1-1-0

_wfullpath _wstat64i32

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy strchr wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _errno _exit _getpid _set_app_type _initialize_wide_environment _initterm _initterm_e _set_invalid_parameter_handler _wcserror abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf _fileno _get_osfhandle _wfopen _wtempnam clearerr fclose feof ferror fflush fread fseek fwrite ftell setbuf setvbuf

api-ms-win-crt-string-l1-1-0

_stricmp _strdup _strnicmp _wcsdup _wcsdup _wcsnicmp iswctype memset strcmp strcpy strlen strncat strncmp strncpy wcscat wcscmp wcslen wcsncmp

user32

CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageW DrawTextW EndDialog GetClientRect GetCursorPos GetDC GetDialogBaseUnits GetMessageW GetMonitorInfoW GetSystemMetrics GetWindowLongPtrW InvalidateRect MessageBoxA MessageBoxW MonitorFromPoint MoveWindow MsgWaitForMultipleObjects PeekMessageW PostMessageW RegisterClassW ReleaseDC SendMessageW SetWindowLongPtrW ShowWindow ShutdownBlockReasonCreate SystemParametersInfoW TranslateMessage

Name

.text

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

PE Signature issue

advapi32

comctl32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

user32

generic

*k�+ ƻ.pyc