blankgrabber | 5b666e27a3efb7d600aa3a20615435bbe5215345232348c4bf2a2bb04f6fc68c

General

Target
2026-07-31_fec7f57e0411540ad655209818234298_akira_cobalt-strike_coinminer_glassworm_hijackloader_vidar
Size 63.5MB
Sample260731-2y5vmsaa47
SHA256 5b666e27a3efb7d600aa3a20615435bbe5215345232348c4bf2a2bb04f6fc68c
MD5 fec7f57e0411540ad655209818234298
SHA1 25e075bd3c039245f581782484b72a617d275922
SHA512 7b1d56460771d6f6b4f5e74b8ea8f913d55bc977ddc3b339231b0e998953ec2ca47b9734dce08becb8f3f477354f1f4b41dded649ee7ee15b9f8e5b043615304
SSDEEP 786432:K5vUli6L8XuD1b2fEt1PaA6AqYYcv+EKefBLPjy76ArK:KCvwXq2fESEKw186ArK
TLSH
T126E77C06F27110AAD966D0B48A179163E770FC2D173076FB26D9A6292F33FE16A3C744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-31_fec7f57e0411540ad655209818234298_akira_cobalt-strike_coinminer_glassworm_hijackloader_vidar
- Size 63.5MB
- SHA256 5b666e27a3efb7d600aa3a20615435bbe5215345232348c4bf2a2bb04f6fc68c
- MD5 fec7f57e0411540ad655209818234298
- SHA1 25e075bd3c039245f581782484b72a617d275922
- SHA512 7b1d56460771d6f6b4f5e74b8ea8f913d55bc977ddc3b339231b0e998953ec2ca47b9734dce08becb8f3f477354f1f4b41dded649ee7ee15b9f8e5b043615304
- SSDEEP 786432:K5vUli6L8XuD1b2fEt1PaA6AqYYcv+EKefBLPjy76ArK:KCvwXq2fESEKw186ArK
- TLSH
  T126E77C06F27110AAD966D0B48A179163E770FC2D173076FB26D9A6292F33FE16A3C744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution blankgrabber spyware stealer
- A stealer written in Python and packaged with Pyinstaller
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2