blankgrabber | 7ab149192940b747c6fbf05b7b6214d45411d22919ec6c0f0f0c47a911afefef

General

Target
fud-crypter-main.zip
Size 8.1MB
Sample260805-pff3ca1xfx
SHA256 7ab149192940b747c6fbf05b7b6214d45411d22919ec6c0f0f0c47a911afefef
MD5 f7acc46f25ea17f55b25cf3566865ad5
SHA1 dfc5592ad65525e5996efc8bc0b07ff25b3b5cab
SHA512 6f477c9861793883f5d124eaa0587efad05894cf384a6970c0bd3d1154d1cf5f32f0c4032924a766070ca3641ebacadf9652493aeb92eef2f0fc9740297908f6
SSDEEP 196608:Tik14ixCV73I39pJ8PlwWw53+ULs7RWX7eKRwasOBd43OAfmM/+xfB:1dCypJ8uWYrLs7wqLXOBm+q1/+hB
TLSH
T1E886337CDC8AC9956D9707FF53C26F7A3BAD50A48C536F12E3621309EC4E0C23929966
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Lime-Crypter.exe
- Size 8.1MB
- SHA256 61a55cf54529fdab7b1c462e75aea3257a1862f7a2ba84359f67a6e6ccc37afe
- MD5 1c1b49578534a1c285a26445747a8e1f
- SHA1 84d1af71b59fee58cfef913e39be6571aa483107
- SHA512 baf93ee44bb4dc90c8894071b04de325c22d3ca3ac14754456fca2518799d4874860f94814f9ea3c95a48b3ab699c0c3daa8febe189df70114bce30faf9e1e42
- SSDEEP 196608:LQBALZR3uUhKKMkS0lHJgVbzvpIWp1PlpTHrjxM:LQBKHuUhqkS0tCVbzvtH7TXxM
- TLSH
  T167863302E31DE88FE784F939C38DD7701B072E85A9E064541A8AA7F3595B19F8835F4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution blankgrabber persistence privilege_escalation spyware stealer upx
- A stealer written in Python and packaged with Pyinstaller
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2