General

  • Target
    https://cdn.discordapp.com/attachments/1359911467326898186/1528014337497628822/Eclipse_AE_Macro.zip?ex=6a5cc1bf&is=6a5b703f&hm=2e5ef36f30657b17254c9e4b2e7fbf880618e1b693cbd077d29f0e947a85fc06&
  • Sample260718-pml7yabv7k

Malware Config

Targets

    • Target
      https://cdn.discordapp.com/attachments/1359911467326898186/1528014337497628822/Eclipse_AE_Macro.zip?ex=6a5cc1bf&is=6a5b703f&hm=2e5ef36f30657b17254c9e4b2e7fbf880618e1b693cbd077d29f0e947a85fc06&
    • A stealer written in Python and packaged with Pyinstaller

    • Family: blankgrabber

      Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v16

Tasks