General
- Target 2026-07-14_f87ba53c7e88793b6d9dc34adbc83339_blankgrabber_icedid_luca-stealer_njrat
- Size 53.6MB
- Sample260714-c7b69acx3m
- SHA256 2909896d76a634e46b6660c568514674c6b3d2f786e5ee86b5e6883ecf47ea3d
- MD5 f87ba53c7e88793b6d9dc34adbc83339
- SHA1 5ceaadad009c6ad3dc47c3e08116883e87dbbf6c
- SHA512 7648360d95afe82026450890e8135288deb6f43cfaf3502a94f08c7c2a7fd559d7bea21db7cafe4dfe4bad22a18006344378d17c1483b22a0a786d2995f91f0e
- SSDEEP 1572864:eIBcabtxqu2OtvaGYl01Wu32uDWDi2b4aq8m2rtQ2:hbzXt0GYl0z1miR1YpQ
- TLSH T126C7331DF0F584CFCAEF963F11459656F1923E1A864430ABA999F1E868FFBE51C39002
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_f87ba53c7e88793b6d9dc34adbc83339_blankgrabber_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_f87ba53c7e88793b6d9dc34adbc83339_blankgrabber_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260710-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_f87ba53c7e88793b6d9dc34adbc83339_blankgrabber_icedid_luca-stealer_njrat
- Size 53.6MB
- SHA256 2909896d76a634e46b6660c568514674c6b3d2f786e5ee86b5e6883ecf47ea3d
- MD5 f87ba53c7e88793b6d9dc34adbc83339
- SHA1 5ceaadad009c6ad3dc47c3e08116883e87dbbf6c
- SHA512 7648360d95afe82026450890e8135288deb6f43cfaf3502a94f08c7c2a7fd559d7bea21db7cafe4dfe4bad22a18006344378d17c1483b22a0a786d2995f91f0e
- SSDEEP 1572864:eIBcabtxqu2OtvaGYl01Wu32uDWDi2b4aq8m2rtQ2:hbzXt0GYl0z1miR1YpQ
- TLSH T126C7331DF0F584CFCAEF963F11459656F1923E1A864430ABA999F1E868FFBE51C39002
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
A stealer written in Python and packaged with Pyinstaller
-
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables referencing virtualization MAC addresses
-
Loads dropped DLL