blank_grabber | stub[.]py

Resubmissions

14/10/2026, 15:25

261014-stsvvaty8m10

14/10/2026, 14:04

261014-rdgbfady7l10

Analysis

custom tags

networkinfostealer

Sharing

Copy URL Twitter E-mail

General

Target
stub.py
Size 86KB
Sample261014-rdgbfady7l
SHA256 dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded
MD5 b405dca14b7b93b0cfa4cf0173f037e9
SHA1 fe72742911ad8c9b31ba17dce3ffcb568b4e7457
SHA512 c4a3243d136f60ae7e5d412a91b69cc00a7eb327149f45ff6bbaca0082ca0fa17f566f205d448b4de97b19ccf3c06d660470eaff7ced5f45703346dd9a9f4ccd
SSDEEP 1536:GKYbFNbqPDxK3fF0USPUJvUrViwBjNjXZELqDOqokprthEcfn:GtRNbqPK0UScJvUrViwNBXZENqokprtv
TLSH
T13F83EA2ADD16292683D7D3912E4585C2371CED67871628307DEC52582F0DEB4C3FAAED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

blank_grabber stealer blankgrabber network infostealer

Malware Config

Signatures

Family: blank_grabber
blank_grabber
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

Blank Grabber infostealer - deobfuscated payload (stage 3) 1 IoCs

Matches plaintext strings from the AES-decrypted BlankOBF payload of Blank Grabber (PyInstaller 3.11 stage chain: loader-o -> blank.aes/stub-o -> stealer). Captures Discord tokens, browser credentials, game sessions, crypto wallets and exfiltrates via Discord webhook / gofile / anonfiles.

infostealer stealer

resource	yara_rule
sample	family_blank_grabber_payload

Detects BlankGrabber stealer in memory 1 IoCs

resource	yara_rule
sample	blankgrabber_dmp

Detects references to legitimate web services potentially used as dead drop resolvers 1 IoCs

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

network

resource	yara_rule
sample	potential_ddr

File Explorer

stub.py

86KB

stub.py

SHA256 dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded
MD5 b405dca14b7b93b0cfa4cf0173f037e9
SHA1 fe72742911ad8c9b31ba17dce3ffcb568b4e7457
SHA512 c4a3243d136f60ae7e5d412a91b69cc00a7eb327149f45ff6bbaca0082ca0fa17f566f205d448b4de97b19ccf3c06d660470eaff7ced5f45703346dd9a9f4ccd
SSDEEP 1536:GKYbFNbqPDxK3fF0USPUJvUrViwBjNjXZELqDOqokprthEcfn:GtRNbqPK0UScJvUrViwNBXZENqokprtv
TLSH
T13F83EA2ADD16292683D7D3912E4585C2371CED67871628307DEC52582F0DEB4C3FAAED
MD5 SHA1 SHA512 SSDEEP TLSH

Blank Grabber infostealer - deobfuscated payload (stage 3)

Matches plaintext strings from the AES-decrypted BlankOBF payload of Blank Grabber (PyInstaller 3.11 stage chain: loader-o -> blank.aes/stub-o -> stealer). Captures Discord tokens, browser credentials, game sessions, crypto wallets and exfiltrates via Discord webhook / gofile / anonfiles.

infostealer stealer
Detects BlankGrabber stealer in memory
Detects references to legitimate web services potentially used as dead drop resolvers

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

network