blankgrabber | 86b23ba96654bfd2e0228e70131ba440de40abbf2d70f474bf9aa807b610c71a

General

Target
2026-08-07_8f73963bcc496c59ede9e44745ec435e_cobalt-strike_glassworm_icedid_njrat_satacom
Size 16.5MB
Sample260807-w2hlmat1a1
SHA256 86b23ba96654bfd2e0228e70131ba440de40abbf2d70f474bf9aa807b610c71a
MD5 8f73963bcc496c59ede9e44745ec435e
SHA1 f9e1e210a34d05c166bed1dfccd74c8133dca18c
SHA512 756d0454982e1c6ab9ecd7678060813a68a33e06b4be4b5eb894f0ca07c1060c13de84b3f706ec440df3d8410a477c3880b26efaef5007a9ea3de9cc2bd10783
SSDEEP 393216:M5Iy9BVEE0t7RLaV9K2pM9B3QZSPl3s89VqkHVkptz7qWPazdMlSt:dkKkeA4l3s86kHVkpFqDzd22
TLSH
T1A107239E635422ECC46BC0788523DE06F3B2741E07A1D7EF72D697912F13AE09A36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-07_8f73963bcc496c59ede9e44745ec435e_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 16.5MB
- SHA256 86b23ba96654bfd2e0228e70131ba440de40abbf2d70f474bf9aa807b610c71a
- MD5 8f73963bcc496c59ede9e44745ec435e
- SHA1 f9e1e210a34d05c166bed1dfccd74c8133dca18c
- SHA512 756d0454982e1c6ab9ecd7678060813a68a33e06b4be4b5eb894f0ca07c1060c13de84b3f706ec440df3d8410a477c3880b26efaef5007a9ea3de9cc2bd10783
- SSDEEP 393216:M5Iy9BVEE0t7RLaV9K2pM9B3QZSPl3s89VqkHVkptz7qWPazdMlSt:dkKkeA4l3s86kHVkpFqDzd22
- TLSH
  T1A107239E635422ECC46BC0788523DE06F3B2741E07A1D7EF72D697912F13AE09A36B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution blankgrabber darksiderat persistence privilege_escalation spyware stealer trojan upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2