blankgrabber | 30d3b8de8e0a0d229ec217b3da7752ed5e14f0c33ab379ad5bec4cee51b55ec9

General

Target
2026-10-27_f92c282acbb568b82e9b0357ca6b8f11_blankgrabber_cobalt-strike_icedid_njrat_satacom
Size 12.9MB
Sample261027-zpr63sed82
SHA256 30d3b8de8e0a0d229ec217b3da7752ed5e14f0c33ab379ad5bec4cee51b55ec9
MD5 f92c282acbb568b82e9b0357ca6b8f11
SHA1 daa502f1bdab601489e56ad20bd57feeb5537bb4
SHA512 5c8b7024046478f5135ee73abdc5e65978f21586ec5d60e97680e4afe079e47e7dae7864212ab19142b519b60db7e08497c06aa843f639544ce8d3f08d360bf5
SSDEEP 393216:296o2qLcaVf8AJleLP7UZM252Ub2gzTDJsuT:24cAE9buQW252UFZsuT
TLSH
T1B5D63358C09180D5EAD31A38C9CA2259FFBC3C9283A483B75AD496F53EF35D05A7137A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-27_f92c282acbb568b82e9b0357ca6b8f11_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 12.9MB
- SHA256 30d3b8de8e0a0d229ec217b3da7752ed5e14f0c33ab379ad5bec4cee51b55ec9
- MD5 f92c282acbb568b82e9b0357ca6b8f11
- SHA1 daa502f1bdab601489e56ad20bd57feeb5537bb4
- SHA512 5c8b7024046478f5135ee73abdc5e65978f21586ec5d60e97680e4afe079e47e7dae7864212ab19142b519b60db7e08497c06aa843f639544ce8d3f08d360bf5
- SSDEEP 393216:296o2qLcaVf8AJleLP7UZM252Ub2gzTDJsuT:24cAE9buQW252UFZsuT
- TLSH
  T1B5D63358C09180D5EAD31A38C9CA2259FFBC3C9283A483B75AD496F53EF35D05A7137A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution blankgrabber persistence privilege_escalation spyware stealer trojan
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Detects BlankGrabber stealer in memory
- Family: blankgrabber
  Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
  stealer blankgrabber
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing artifacts associated with disabling Widnows Defender
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Adds policy Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2