blank_grabber | 9d02e370b7c79d2472d96af30c38e4fca1181710f682ddbdd12059da645ac999

General

Target
Default.exe
Size 7.4MB
Sample261011-27hfpsah93
SHA256 9d02e370b7c79d2472d96af30c38e4fca1181710f682ddbdd12059da645ac999
MD5 e96fd190a093e47ad5cbed527304ed06
SHA1 545574d7aa41c7c9b77f9922b2ab063dd1ca21d7
SHA512 ad591773db9fbf1a59b9593e38b0928bbc9e3a1de22306943dd2feb1cd6866ef5a61455b80f7a4490f26985f2f471f6ad99b19c3d8aace54a154fdf726aaab7e
SSDEEP 196608:KN3vdWKsAZAXrbfsOcmOJWFjFuSGoDLe96D:K3W0ZAvfF60jFdJS96D
TLSH
T17D76337BF963168CC98BA0B449DB36E73494FC55483AC0BF5DF686349623C909AE06C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Default.exe
- Size 7.4MB
- SHA256 9d02e370b7c79d2472d96af30c38e4fca1181710f682ddbdd12059da645ac999
- MD5 e96fd190a093e47ad5cbed527304ed06
- SHA1 545574d7aa41c7c9b77f9922b2ab063dd1ca21d7
- SHA512 ad591773db9fbf1a59b9593e38b0928bbc9e3a1de22306943dd2feb1cd6866ef5a61455b80f7a4490f26985f2f471f6ad99b19c3d8aace54a154fdf726aaab7e
- SSDEEP 196608:KN3vdWKsAZAXrbfsOcmOJWFjFuSGoDLe96D:K3W0ZAvfF60jFdJS96D
- TLSH
  T17D76337BF963168CC98BA0B449DB36E73494FC55483AC0BF5DF686349623C909AE06C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution blank_grabber blankgrabber infostealer network persistence privilege_escalation spyware stealer
- Custom signature
  
  Blank Grabber infostealer - deobfuscated payload (stage 3)
  Matches plaintext strings from the AES-decrypted BlankOBF payload of Blank Grabber (PyInstaller 3.11 stage chain: loader-o -> blank.aes/stub-o -> stealer). Captures Discord tokens, browser credentials, game sessions, crypto wallets and exfiltrates via Discord webhook / gofile / anonfiles.
  infostealer stealer
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blank_grabber
  blank_grabber
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Custom signature
  
  Detects references to legitimate web services potentially used as dead drop resolvers
  Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
  network
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2