blankgrabber | 1b136efeeb1fff3f5093e0cb12e7b0828043f8418c0ea9bc527e5c55aeea972c

Sharing

Copy URL Twitter E-mail

General

Target
a.rar
Size 12.7MB
Sample260914-tddlnatbkh
SHA256 1b136efeeb1fff3f5093e0cb12e7b0828043f8418c0ea9bc527e5c55aeea972c
MD5 b22647a692a9157a05499ad73e44c8a3
SHA1 16d9c75bd954b94fc03d3546e3b18fd6e05652c0
SHA512 b41ea66e65761b30de3ca8d8c66556f077d58da22e115e1b371a901cc9bce5b940a417e0e31709fa8af838d79658d929f86ac46d087f177437ce1b711605c6d0
SSDEEP 393216:MGtIDlOyPdQ87/mJNZFnxglnZOA/syyk7ODUf5:MGttyPdL7uJY1ZOgqDUf5
TLSH
T192D633F964DA1DB9C2E34F095BD54C7DC184E62CEB6E468D0063C74E74848FDDA8CAA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

blankgrabber stealer

Malware Config

Targets

- Target
  a/.dll
- Size 9KB
- SHA256 a186e51e8edda92120f1778866b3ee80d593ea2b66a0ce1bd47b48770e428fd6
- MD5 ae72265225de42b6685f04d79c49725e
- SHA1 eecdee534a3467e3ea6876fe854be8f82e1223ab
- SHA512 89aa71b6ac3578a13ca42ba15a9d69ce30e647fb284635565c7f6c57c48c2383a025b2101e0054376724530547526612ba715971bf325978cccafc6dc264e022
- SSDEEP 192:b0SDGk0r6RoDxddtmMtnlxSaKsFshUhaBKldUMi0DEyKKJmVpF+V:b0SSzCWlxsv2haBKQ7040mFO
- TLSH
  T1DB129207FAF8CF6DC94A08B9D262531977B0C75CD306071492A7E274ED8A39923B2B64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  a/BouncyCastle.Crypto.dll
- Size 2.5MB
- SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
- MD5 f0b3e112ce4807a28e2b5d66a840ed7f
- SHA1 54a6743781fd4ceb720331fce92f16186931192d
- SHA512 dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190
- SSDEEP 49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr
- TLSH
  T132C53A1877F40613D6BAE7B595F09021A3F0F46EB393FB0B6591A7B50C13BA24C816A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  a/Costura.dll
- Size 4KB
- SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
- MD5 d075a47a551e53e27889f83670a581e1
- SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
- SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
- TLSH
  T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  a/FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- TLSH
  T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  a/Guna.UI2.dll
- Size 2.1MB
- SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
- MD5 b464fc896b14bfa34f608da53856e999
- SHA1 55568eecc97895cad49a42bffe757e3588c5313c
- SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
- SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
- TLSH
  T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  a/IconExtractor.dll
- Size 10KB
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH
  T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  a/Ittihad v1.2-cleaned_Slayed.exe
- Size 18.3MB
- SHA256 e2494c11f39528326d94f22d2e1d521bd30ffc0b7412a3606c01e79a44bdb141
- MD5 9cf373b0d2f96a889287ddd427d00b86
- SHA1 54bc12a4fa97c6f2f19bb29888f7fcc53884ac9b
- SHA512 2b71ea20115957a0b30c36aac7f68c05e4a9f0226c0f9045ac9c4f04e37621f39be30b255c20b15a455c073453db128a77dbd93514cb75b945a4c4cb8113693e
- SSDEEP 393216:b9FOgKbe5CrrrrrlRV7rrrw5rrrrrrMAO1eE0gsfqH13D7BIqI:b/fK65CrrrrrlRV7rrrYrrrrrrjtERTi
- TLSH
  T128170226B3028A62C648433A5452D334C3359CB5AB12571F7FCCBE6A3BFB5D46B266C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

blankgrabber stealer
- Detects BlankGrabber stealer in memory
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
behavioral13 behavioral14
- Target
  a/Mono.Cecil.Mdb.dll
- Size 42KB
- SHA256 570a437dea0271d1d5c8b7d6a408b0b2635bdb0e8b8d5051878f3e7fca087f89
- MD5 2c39a53a61168c8a7a9f53ebdad6137a
- SHA1 b10ac8325cd72c7a9018af806d75739ab862b4d8
- SHA512 d1987995bb58978a063a195a18ba02908edac02a3e7808e93f8340aa968c9bd74f76d2e6fad8158f72bc3629c1382039863471d51e510bd897187ccdabae8e14
- SSDEEP 768:wlUj6BAKp/zgvVucdcRsCVKcraB09THkPFtQI4CRIzZwMNTBczwDN:0h3/zgvVPcRrK09HkBAwMNTNN
- TLSH
  T135132A1067AD9B27C2AD8AFDF482911507F09125B623FB9B9FC4F4EB6C47B85050227B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  a/Mono.Cecil.Pdb.dll
- Size 88KB
- SHA256 50a1a1a79dc86fcfb8b51249b5325a10dd93d193c52999cf6775d25030a4e606
- MD5 5f6a2f17f4e792600a13e3771d5ca5ff
- SHA1 e411b8e51b201c5f389c2388d26735c1e89b3f6f
- SHA512 67af09a5545c6bb0e033cfa09dfc654ce4cd4d22c418402d5a43612eaa6e60b71dca2bf4f796a6027c8e7aece88d418e6e8c469c94c327f5169608e67a3e7a39
- SSDEEP 1536:TexPta15J8wWI7Kgl74TChe44tALYKXybJG3OoCkvV:TexFafB7q2hwArQJGFhvV
- TLSH
  T137937E3A9B98FA27C3ECAD7724A60D0907F1D126E153FB55C98959F8381BB301232797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  a/Mono.Cecil.Rocks.dll
- Size 29KB
- SHA256 842e09959084eda733aab1a5354d7af79e29594f4d8b91c8792103e5c755ed9b
- MD5 e136924bb4051a462ad90bd14cb0ba41
- SHA1 8cfeb4034766ce06f9216b1872703015e8ea0e09
- SHA512 1baa852ffa42fd8a743661f003b90c840276b4cd864d5467b8d551454420ea46bb6c97e0dbe832de1e5e0672eb57365332dd5f86ad1df88820300504a3b1ea07
- SSDEEP 768:628hQuem5RPkF+pXtRx/hRsPveQJcpAUdE3fF7Mtm3M:62gYm5RPv9jjsPveQCdEvF7Mtmc
- TLSH
  T1B2D229022B68CB77D6EF4575B8F0212842B1D39F6803C76E4DCC61E9A947B8567217F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  a/Mono.Cecil.dll
- Size 354KB
- SHA256 c41bdb9ffd3c5f6e17d2382c1012d73703e035e3f1100245fdd4e08c8dc6eb5b
- MD5 2f096535c228ab0d2082adfc01678481
- SHA1 0e0dcb36aa56e7f99aa524cfb3c72e4918cc5b32
- SHA512 9f54b9e85ef70afcb36569885de73bba704a8901c8ddbb5a35de6a1921d4d42f88026aea41ed77ec7a8041ee8a04efef817deda7dea0f29a716dab7a6ea7fd9e
- SSDEEP 6144:LHNGIaxcvxT+2pEwMjbLmRlQ5+A45iziJCJP+pIoTtya:RRUQCmRw4szYCOI
- TLSH
  T165747B2167EC163BCADFA37BD06B042D46F9D015638FDB8D6D84A6F91C83FA65800267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  a/Mono.TextTemplating.dll
- Size 170KB
- SHA256 2ab59b090275e66a6d31560fb8e82b08ffc4c6b5531392f307178c42681a52c9
- MD5 a902ed14c16a0713b31ae42a36bcc482
- SHA1 b020133cf85da24a4b527a44a5634e5203eaa65f
- SHA512 4447dc5cff9de98422e3904d3d8c4c251d3144eedff83d621d9aee538972a45ac8b5331000b97d52cf32b3cb3ed8e13693cf4c70e0cd04335a5c1ba780449391
- SSDEEP 3072:Yesac/pAhHg07rSjJooBK7665laKZ8oeVnLNk0DtcvvLXpyqDThDz8Birn:PgAhHgeS0665MKZ2LNLmLXkqXhz8Bir
- TLSH
  T1CD045A2813EC4B66E7FF5B38F834901146B1F966A926D7AE0D04A5ED1D13B40E921FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  a/Newtonsoft.Json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  a/Vestris.ResourceLib.dll
- Size 76KB
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- TLSH
  T13B731C1C977C8BE6C2FE06B9B422190667F0C706F22FE75EDDC8A4E97C957920612193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  a/cGeoIp.dll
- Size 2.3MB
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- TLSH
  T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  a/dnlib.dll
- Size 1.1MB
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH
  T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Detects BlankGrabber stealer in memory

Family: blankgrabber

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32