blankgrabber | b0d003655e79422225a71075112324d5b83824f6d7d9d868b562ee259c304798

General

Target
2026-06-27_01f75487564638ce1ca0e61e6942d9f4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 6.7MB
Sample260629-mp8slsc17q
SHA256 b0d003655e79422225a71075112324d5b83824f6d7d9d868b562ee259c304798
MD5 01f75487564638ce1ca0e61e6942d9f4
SHA1 3ae1360d1fcc72ab997313aa97cb7280cd14437d
SHA512 987599a252042abe69dc1a258d73343f826e127a8284caa26bd522073d5955b2a1ab827aeedd6e983d54e5de9e2d654e0e0136f8aab94e21ecaf648733774c20
SSDEEP 196608:9eumWHlOjmFwDRxtYSHdK34kdai7bN3m5N0wxHi:9RAK2pM9B3Q5+SC
TLSH
T13D663314735102F5E5F3613DC8638229D97278152750CADF87A8C7B62E23AF08E7E76A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-27_01f75487564638ce1ca0e61e6942d9f4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 6.7MB
- SHA256 b0d003655e79422225a71075112324d5b83824f6d7d9d868b562ee259c304798
- MD5 01f75487564638ce1ca0e61e6942d9f4
- SHA1 3ae1360d1fcc72ab997313aa97cb7280cd14437d
- SHA512 987599a252042abe69dc1a258d73343f826e127a8284caa26bd522073d5955b2a1ab827aeedd6e983d54e5de9e2d654e0e0136f8aab94e21ecaf648733774c20
- SSDEEP 196608:9eumWHlOjmFwDRxtYSHdK34kdai7bN3m5N0wxHi:9RAK2pM9B3Q5+SC
- TLSH
  T13D663314735102F5E5F3613DC8638229D97278152750CADF87A8C7B62E23AF08E7E76A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx adware blankgrabber ransomware
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2