blankgrabber | a48cd0cdf81099014e4fba7634733a2b63055fb963ce1a1798b89f20189453f2

General

Target
WindowsUpdate.exe
Size 19.9MB
Sample260703-3fx8hsdt6p
SHA256 a48cd0cdf81099014e4fba7634733a2b63055fb963ce1a1798b89f20189453f2
MD5 80065c6fdf08d712beb8f4d79acbb9aa
SHA1 033965d592e478c7420719d1e7efa48d06c6c3b3
SHA512 c92f9f0af95fdd5d97c4d5b49862d2dd687e6467ca199fde7c1e6c6ea1a796020c5cc505a9192855b0fa73379ef0b9d2b0e56999b2271eed7806263b983a93f9
SSDEEP 393216:DiYb4audHAoYydA++V1rvUvumuWwHVa0SkmBNqhqQHWvE2L:t45HAo32zL9mJwVbjEBvvhL
TLSH
T1572733927271547EC292887432B975A3FBC5296243BA80F377B185811A73DC09B7E1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WindowsUpdate.exe
- Size 19.9MB
- SHA256 a48cd0cdf81099014e4fba7634733a2b63055fb963ce1a1798b89f20189453f2
- MD5 80065c6fdf08d712beb8f4d79acbb9aa
- SHA1 033965d592e478c7420719d1e7efa48d06c6c3b3
- SHA512 c92f9f0af95fdd5d97c4d5b49862d2dd687e6467ca199fde7c1e6c6ea1a796020c5cc505a9192855b0fa73379ef0b9d2b0e56999b2271eed7806263b983a93f9
- SSDEEP 393216:DiYb4audHAoYydA++V1rvUvumuWwHVa0SkmBNqhqQHWvE2L:t45HAo32zL9mJwVbjEBvvhL
- TLSH
  T1572733927271547EC292887432B975A3FBC5296243BA80F377B185811A73DC09B7E1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery blankgrabber persistence privilege_escalation spyware stealer trojan
- A stealer written in Python and packaged with Pyinstaller
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1