blankgrabber | 5776b9a7c76c2f52fe4e50b8104dd32c2b1f5b37dd33d3d94f78bf4cec4547ff

Sharing

General

Target
Built.exe
Size 7.5MB
Sample260705-lc2yvsbt5z
SHA256 5776b9a7c76c2f52fe4e50b8104dd32c2b1f5b37dd33d3d94f78bf4cec4547ff
MD5 be8dee2881598828c0aeaa723b03d6c3
SHA1 0fd32c5f4d1913f9a5c9ee9d6212d1aa262dfd56
SHA512 9a50692db1cfcce240c267c8e0111883cf6c4a63892f0b08fc0dbe1ba9c5051d9e425f21cfc2ea43d537542921b5201debbc7c7abc830a7906f486e879fdd890
SSDEEP 196608:UgFv3ZV3zOjmFQR4MVGFtwLP7nL225R+q/:RV3aKtM5LP7hE6
TLSH
T1FE8633CD9BE107F6E4B3923C8183C152DB31B92647A8CADF07E057256E232D2993EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Built.exe
- Size 7.5MB
- SHA256 5776b9a7c76c2f52fe4e50b8104dd32c2b1f5b37dd33d3d94f78bf4cec4547ff
- MD5 be8dee2881598828c0aeaa723b03d6c3
- SHA1 0fd32c5f4d1913f9a5c9ee9d6212d1aa262dfd56
- SHA512 9a50692db1cfcce240c267c8e0111883cf6c4a63892f0b08fc0dbe1ba9c5051d9e425f21cfc2ea43d537542921b5201debbc7c7abc830a7906f486e879fdd890
- SSDEEP 196608:UgFv3ZV3zOjmFQR4MVGFtwLP7nL225R+q/:RV3aKtM5LP7hE6
- TLSH
  T1FE8633CD9BE107F6E4B3923C8183C152DB31B92647A8CADF07E057256E232D2993EB55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware credential_access defense_evasion discovery execution blankgrabber persistence privilege_escalation ransomware spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  ��Ok��o.pyc
- Size 1KB
- SHA256 20885f177b1eca20c9841cc5c320e49de30ebca7bb95137a10475fbced19395b
- MD5 3a28d3afba9906d16bcc66ee77ec3d0c
- SHA1 2bd0b12ff79ed01a18b102f7469cea59f6c6ef0e
- SHA512 1946eb9683931127ab64ae2d3c7e3fe4ffbf36710f57935d53306ad767567dc18aa669759741af518d8d51428e29065fe351c7a0e968ca87a9aed101e0a9763b
- TLSH
  T1D13120C302A2CD3EFCAAD33C913D4C9673E0D5E4FA0D6293290E113E5DA4824B8525EC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8