blank_grabber | 5602547f1c70af08f6652a309ffe8ec554aa59f9368110a8ddfbbc60c8d5cb61

General

Target
Ryo.exe
Size 7.4MB
Sample261011-26ryrasv2q
SHA256 5602547f1c70af08f6652a309ffe8ec554aa59f9368110a8ddfbbc60c8d5cb61
MD5 cb60a2ddc6367f8b6fc7db4bc3f0cff9
SHA1 4224f23459760b97f5708e096e16b3400a95c1f9
SHA512 29176e4fc89a2a518fee7a2d150d7cb076af20af95b30803854e5c2b1cce909a4e3e4daf56dc60df0faa70c53dc96eee75bab4bd5449de9a10bd8d35fd352bc9
SSDEEP 98304:RSi1YZ7X4urErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EzKhudJ1XmYC:YkYZcurErvI9pWjgfPvzm6gsFE2EL6z
TLSH
T1F6763392A3A505B8F4BA423D86B3D016DBB2786613E4C1EF03F052577F036E58E39B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Ryo.exe
- Size 7.4MB
- SHA256 5602547f1c70af08f6652a309ffe8ec554aa59f9368110a8ddfbbc60c8d5cb61
- MD5 cb60a2ddc6367f8b6fc7db4bc3f0cff9
- SHA1 4224f23459760b97f5708e096e16b3400a95c1f9
- SHA512 29176e4fc89a2a518fee7a2d150d7cb076af20af95b30803854e5c2b1cce909a4e3e4daf56dc60df0faa70c53dc96eee75bab4bd5449de9a10bd8d35fd352bc9
- SSDEEP 98304:RSi1YZ7X4urErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EzKhudJ1XmYC:YkYZcurErvI9pWjgfPvzm6gsFE2EL6z
- TLSH
  T1F6763392A3A505B8F4BA423D86B3D016DBB2786613E4C1EF03F052577F036E58E39B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution blank_grabber blankgrabber infostealer spyware stealer upx network
- Blank Grabber infostealer - deobfuscated payload (stage 3)
  Matches plaintext strings from the AES-decrypted BlankOBF payload of Blank Grabber (PyInstaller 3.11 stage chain: loader-o -> blank.aes/stub-o -> stealer). Captures Discord tokens, browser credentials, game sessions, crypto wallets and exfiltrates via Discord webhook / gofile / anonfiles.
  infostealer stealer
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blank_grabber
  blank_grabber
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Detects references to legitimate web services potentially used as dead drop resolvers
  Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
  network
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2