General
- Target 2026-07-27_37fd6c9a9e3dd347ad0d7bd583c21100_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom
- Size 57.9MB
- Sample260727-mggdds1sdt
- SHA256 0553e6a190b67a7316432357f6edaa85e22f6f5a53f6898e5559f796222aa14e
- MD5 37fd6c9a9e3dd347ad0d7bd583c21100
- SHA1 db112e4fc8d5f21ba5918c555d336001143808b9
- SHA512 16752e0df88d8caf4b2bd7214f3b67d7c7c48451f7ff3694a571414aec94d1e20e0410e65bc8263f823c46f263a95b21624f0618dbbcd3ae140e626a90c889eb
- SSDEEP 1572864:VDxzVQ2ygEwFYgc+ab9YQVTmygAM74I958rlxFhZax:tNW2ysNQhmbWIH8fFhU
- TLSH T182D7338CC993526EDA55F630C50D9A82BA13AC5322839CB7C670B769BDB7DE60C3DC05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_37fd6c9a9e3dd347ad0d7bd583c21100_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_37fd6c9a9e3dd347ad0d7bd583c21100_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_37fd6c9a9e3dd347ad0d7bd583c21100_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom
- Size 57.9MB
- SHA256 0553e6a190b67a7316432357f6edaa85e22f6f5a53f6898e5559f796222aa14e
- MD5 37fd6c9a9e3dd347ad0d7bd583c21100
- SHA1 db112e4fc8d5f21ba5918c555d336001143808b9
- SHA512 16752e0df88d8caf4b2bd7214f3b67d7c7c48451f7ff3694a571414aec94d1e20e0410e65bc8263f823c46f263a95b21624f0618dbbcd3ae140e626a90c889eb
- SSDEEP 1572864:VDxzVQ2ygEwFYgc+ab9YQVTmygAM74I958rlxFhZax:tNW2ysNQhmbWIH8fFhU
- TLSH T182D7338CC993526EDA55F630C50D9A82BA13AC5322839CB7C670B769BDB7DE60C3DC05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
A stealer written in Python and packaged with Pyinstaller
-
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Loads dropped DLL