blankgrabber | bd030ea05b0e2a1709e7dba4dfb5aae1b38ed5d3096f4e82cc7b90d37c72f229

General

Target
Astri.exe
Size 6.9MB
Sample260626-3d17dsft3z
SHA256 bd030ea05b0e2a1709e7dba4dfb5aae1b38ed5d3096f4e82cc7b90d37c72f229
MD5 f661f25ebe308c08f4a13c4c66f01f4d
SHA1 aa717538c9fa2f934d43273ed724c723a4ba5c5a
SHA512 faa37cd0ebab87f2573af02293edef92d237b3b82840e258100f6c2f7593191f98d2efbd1f6f2cb645424f50a6abd5f567703b65fbe36b47ca6d98104d5d3acd
SSDEEP 98304:NGDjWM8JEEFeJbamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRa6mJcp/lq68K:NG0OJeeNTfm/pf+xk4dWRaU/aQo8Mbc
TLSH
T10976332AA7E00DF6EEA7697AC9809458D5B1FC190720CE8B035946FE0F276414D3FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Astri.exe
- Size 6.9MB
- SHA256 bd030ea05b0e2a1709e7dba4dfb5aae1b38ed5d3096f4e82cc7b90d37c72f229
- MD5 f661f25ebe308c08f4a13c4c66f01f4d
- SHA1 aa717538c9fa2f934d43273ed724c723a4ba5c5a
- SHA512 faa37cd0ebab87f2573af02293edef92d237b3b82840e258100f6c2f7593191f98d2efbd1f6f2cb645424f50a6abd5f567703b65fbe36b47ca6d98104d5d3acd
- SSDEEP 98304:NGDjWM8JEEFeJbamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRa6mJcp/lq68K:NG0OJeeNTfm/pf+xk4dWRaU/aQo8Mbc
- TLSH
  T10976332AA7E00DF6EEA7697AC9809458D5B1FC190720CE8B035946FE0F276414D3FF68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx blankgrabber
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2 behavioral3
- Target
  ��.pyc
- Size 1KB
- SHA256 84a7a7e821a164b1c4cea19e63e940e5c0529cf73474f1baa16113e60bce6ea9
- MD5 a8cf23723401601b7391dc298718bba5
- SHA1 4c861514a67a3fd41b285772e917a611c5f546c2
- SHA512 ed973b0360b67fcf46b847af82d44bb69ea0a623cd9440db5ad1703bfad437fca31fc46f67b48e05ac200be8353b71c3e5cc3e15aab3bde71d30b1e980c1aa86
- TLSH
  T19C311F8713A2CE3EF8AAD33C913C5C9AB7E0D5E1F60C6653290E413E9D64924B8525EC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4 behavioral5 behavioral6