blankgrabber | 89a30b52eb99a38959f3616c9f55f274caee5cf60f74ff88353f7ccd0b7988b1

General

Target
delta.exe
Size 6.9MB
Sample260730-sl6fzacj4y
SHA256 89a30b52eb99a38959f3616c9f55f274caee5cf60f74ff88353f7ccd0b7988b1
MD5 2211004fa9d0e6e33910c1622c6b798b
SHA1 af28bf9680b33ad5f6306ef3ad088b90c7b4cf28
SHA512 bd3c4eb4189a8ddf412c19acbf28ccf1efd830bf8cc4d2a89c5a58e33e4fe4f42b7c53773f6d84a284e16679ce21e926437139025fe08550e10744509a0df7f5
SSDEEP 98304:txzHqdVfB2IS3FyuT/9vUIdD9C+z3zO917vOTh+ezDNh7qMJ1nfOBmRqn4mpUJhE:nQsV1bT/9bvLz3S1bA3zNn2gRCkqz
TLSH
T16B7633A9A3D106F4E0B3C63DC3968915DE70752B0768C9CF03E492A62F17AD48E37B65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  delta.exe
- Size 6.9MB
- SHA256 89a30b52eb99a38959f3616c9f55f274caee5cf60f74ff88353f7ccd0b7988b1
- MD5 2211004fa9d0e6e33910c1622c6b798b
- SHA1 af28bf9680b33ad5f6306ef3ad088b90c7b4cf28
- SHA512 bd3c4eb4189a8ddf412c19acbf28ccf1efd830bf8cc4d2a89c5a58e33e4fe4f42b7c53773f6d84a284e16679ce21e926437139025fe08550e10744509a0df7f5
- SSDEEP 98304:txzHqdVfB2IS3FyuT/9vUIdD9C+z3zO917vOTh+ezDNh7qMJ1nfOBmRqn4mpUJhE:nQsV1bT/9bvLz3S1bA3zNn2gRCkqz
- TLSH
  T16B7633A9A3D106F4E0B3C63DC3968915DE70752B0768C9CF03E492A62F17AD48E37B65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution blankgrabber persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  >h��p9b.pyc
- Size 1KB
- SHA256 4dfe0710b36c59bc6d1db6994c42da7c5cce4d86d84dc9fc7359051e810a691f
- MD5 2247392d3e915638f63da47569f74b67
- SHA1 5753d3d812cdacddb185865df11893635af98f48
- SHA512 f9f01a2498f9cdcb7095091241bd995bbee7a5b86c6da765770e8bd76be952b6bd770468e1edf79a27630fed707048b998295f2c44f7c4c53fb45c2fcab961f2
- TLSH
  T1B93123870262CD3EF8AAD37D913C4CAA77E0D5E1FA1C6753280E117E5D64924B8525FC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4