General
- Target 2026-07-14_a5851e74bb792c3667b392588b9e57c6_blankgrabber_icedid_luca-stealer_njrat
- Size 53.1MB
- Sample260714-dwe97sfv8s
- SHA256 9752db967216f829f91893ca86bfb8e239741a6f0cef179523c4d0fbab420951
- MD5 a5851e74bb792c3667b392588b9e57c6
- SHA1 3f2161aad56f9c6ae900cf79a8785975b0d62c07
- SHA512 a516e166348fda01a09a859bb51569ad9f44fcacc85b82eebf039f3284e08ebb200c983b6f7fe71e88b05dfffa010e89308ff90e96a1c9df2a984611c7855a52
- SSDEEP 1572864:8ZatGfRy7rs4t/8Rt9xvegpwFaJc79fHY84tHiZB:NGfRyHhYt7vNMfHveHiZ
- TLSH T1F8C73370B069EC17FA671E7940A8A7B9C1786DB18F348AE3511830DD6BB32F41F1A356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_a5851e74bb792c3667b392588b9e57c6_blankgrabber_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_a5851e74bb792c3667b392588b9e57c6_blankgrabber_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260710-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_a5851e74bb792c3667b392588b9e57c6_blankgrabber_icedid_luca-stealer_njrat
- Size 53.1MB
- SHA256 9752db967216f829f91893ca86bfb8e239741a6f0cef179523c4d0fbab420951
- MD5 a5851e74bb792c3667b392588b9e57c6
- SHA1 3f2161aad56f9c6ae900cf79a8785975b0d62c07
- SHA512 a516e166348fda01a09a859bb51569ad9f44fcacc85b82eebf039f3284e08ebb200c983b6f7fe71e88b05dfffa010e89308ff90e96a1c9df2a984611c7855a52
- SSDEEP 1572864:8ZatGfRy7rs4t/8Rt9xvegpwFaJc79fHY84tHiZB:NGfRyHhYt7vNMfHveHiZ
- TLSH T1F8C73370B069EC17FA671E7940A8A7B9C1786DB18F348AE3511830DD6BB32F41F1A356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
A stealer written in Python and packaged with Pyinstaller
-
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables referencing virtualization MAC addresses
-
Loads dropped DLL