blankgrabber | 14d9a207392e103f58891bd5ba65db9e8a51ebace7ce36d553107f42a651dab6

General

Target
2026-08-15_d18cef511d861de326653b93e98c3c03_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar
Size 76.0MB
Sample260815-drn2jsdr9z
SHA256 14d9a207392e103f58891bd5ba65db9e8a51ebace7ce36d553107f42a651dab6
MD5 d18cef511d861de326653b93e98c3c03
SHA1 bd14c8b39db34e94c44b984060c0b7f69711da6c
SHA512 2d25100ab63415a37f4808e4261c41b17b4c86bdd4fc3eb8252e71b526e38e50c6889382abf0cda824af062780e0f9dfb84b8502eb2cdbf5defc90cfcbba1301
SSDEEP 98304:oceYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbjv9JTSPhlVtQo1fI:oZYmOshoKMuIkhVastRL5Di3tKfSPJI
TLSH
T134083301A3A458EAF851953AC6CAC516D7333A5623E0D58B079887B70F272EE4C3BF57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_d18cef511d861de326653b93e98c3c03_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar
- Size 76.0MB
- SHA256 14d9a207392e103f58891bd5ba65db9e8a51ebace7ce36d553107f42a651dab6
- MD5 d18cef511d861de326653b93e98c3c03
- SHA1 bd14c8b39db34e94c44b984060c0b7f69711da6c
- SHA512 2d25100ab63415a37f4808e4261c41b17b4c86bdd4fc3eb8252e71b526e38e50c6889382abf0cda824af062780e0f9dfb84b8502eb2cdbf5defc90cfcbba1301
- SSDEEP 98304:oceYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbjv9JTSPhlVtQo1fI:oZYmOshoKMuIkhVastRL5Di3tKfSPJI
- TLSH
  T134083301A3A458EAF851953AC6CAC516D7333A5623E0D58B079887B70F272EE4C3BF57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution blankgrabber stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2