blankgrabber | cf5c641eaa67fc14a00134258eae154484d6e32a6f47ba665868ed42e4d0dc9c

General

Target
2026-08-02_5c52d0b64acce71d598a2c8c36b9e480_cobalt-strike_icedid_njrat_satacom
Size 47.5MB
Sample260802-nreszssbja
SHA256 cf5c641eaa67fc14a00134258eae154484d6e32a6f47ba665868ed42e4d0dc9c
MD5 5c52d0b64acce71d598a2c8c36b9e480
SHA1 f5bffe700c0cba4e3a3b751fd4a8687f0ae54b88
SHA512 1d25612f1540e7974615bf884001e7f5b895f85684d45934dbb86fd700ae613b9b8d24f7abab1ded6a09fd7b3987a9ed365638172c3e4a940040199fa6a02ec8
SSDEEP 786432:DdTMG1G9S/87ppPn7sGtbePaIEq9Wd65DObuOYuC6XJXij2kZKSpdUFrNVfvwD:Jbg9b7pPoPaIEbd65DODYuCr6kZKceU
TLSH
T11FB733C3CE2B7598E7A6027E04168211F337186A53EAA1972FA029DB5D14FFC9F95D30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-02_5c52d0b64acce71d598a2c8c36b9e480_cobalt-strike_icedid_njrat_satacom
- Size 47.5MB
- SHA256 cf5c641eaa67fc14a00134258eae154484d6e32a6f47ba665868ed42e4d0dc9c
- MD5 5c52d0b64acce71d598a2c8c36b9e480
- SHA1 f5bffe700c0cba4e3a3b751fd4a8687f0ae54b88
- SHA512 1d25612f1540e7974615bf884001e7f5b895f85684d45934dbb86fd700ae613b9b8d24f7abab1ded6a09fd7b3987a9ed365638172c3e4a940040199fa6a02ec8
- SSDEEP 786432:DdTMG1G9S/87ppPn7sGtbePaIEq9Wd65DObuOYuC6XJXij2kZKSpdUFrNVfvwD:Jbg9b7pPoPaIEbd65DODYuCr6kZKceU
- TLSH
  T11FB733C3CE2B7598E7A6027E04168211F337186A53EAA1972FA029DB5D14FFC9F95D30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution blankgrabber spyware stealer
- A stealer written in Python and packaged with Pyinstaller
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2