Loading malware…
BlankGrabber is a Python-based Windows infostealer that emerged by late 2022 and was publicly identified in 2023. It is commonly packaged with PyInstaller and uses layered obfuscation, encrypted embedded payloads, and deceptive metadata to hinder analysis and appear legitimate. Observed delivery chains include social-engineering-driven distribution through phishing, fake cracked software, Discord-shared archives, fraudulent code repositories, and staged loaders that abuse legitimate Windows utilities before deploying Rust- and Python-based components. Some campaigns have also paired BlankGrabber with XWorm to combine credential theft with broader remote access.
Once executed, BlankGrabber performs extensive anti-analysis and anti-sandbox checks, including inspection of virtualization artifacts, usernames, computer names, UUIDs, and other environment markers associated with analysis systems. It typically creates a mutex to prevent duplicate execution, attempts to obtain elevated privileges, and tampers with Microsoft Defender protections to reduce detection. Reported variants also use persistence mechanisms such as startup-folder placement and Registry Run key execution.
BlankGrabber is designed to harvest a broad range of sensitive information from compromised Windows hosts. Its collection scope includes credentials, cookies, browsing history, autofill data, and other artifacts from Chromium- and Firefox-based browsers; data associated with Discord and Telegram; saved Wi-Fi profiles and passwords; cryptocurrency wallet data and wallet-extension information; clipboard contents; screenshots; webcam captures; system profiling data; and selected local files. The malware has also been reported targeting user data associated with platforms such as Steam and Roblox. Stolen information is exfiltrated to attacker-controlled infrastructure, including channels such as Discord webhooks and Telegram-based mechanisms.
BlankGrabber has been associated with a builder-driven ecosystem that enables operators to customize payload behavior through a graphical interface, contributing to its proliferation and frequent repackaging. Its tradecraft emphasizes scale, accessibility, and effective theft of consumer and prosumer data rather than advanced intrusion sophistication, making it a persistent threat to Windows users and a common example of mass-distributed Python infostealer malware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Code has been obfuscated at multiple levels using the BlankOBF.py ... Later obfuscated code added with some junk codes
Executable looks legitimate with bare eyes and it also got a certificate, although fake, and uses the version information from the “On-Screen Keyboard”
...conducts anti-sandbox checks before decrypting and deploying a self-extracting SFX archive that contains XWorm and the BlankGrabber stealer...
The loader misused certutil.exe, a legitimate built-in Windows utility, to decode what looked like certificate data.
Il intègre également des mécanismes de détection des environnements virtualisés et des sandboxs pour limiter son exécution dans des environnements d'analyse.
As highlighted in Figure 14, it fetches the password, history, cookie and autofill details by querying the sqlite DB which stores the browser activity on the user’s system.
Especially malware like BlankGabber mainly used to collect the discord information from the victim’s machine.
As highlighted in Figure 14, it fetches the password, history, cookie and autofill details by querying the sqlite DB which stores the browser activity on the user’s system.
It checks the environment where the sample is being executed by using a list of Blacklisted UUID, computernames, usernames and tasks
It gets some basic information and MAC address of the victim’s machine as shown in Figure 22.
Malware steals the files which are having some specific extensions that too from the specific folders at the victim’s machine.
Il intègre également des mécanismes de détection des environnements virtualisés et des sandboxs pour limiter son exécution dans des environnements d'analyse.
Après son exécution, le malware collecte les données ciblées, récupère des informations sur le système compromis...
Stealer takes the screenshot when its being executed and stores them as Display (n).png
It targets browser credentials, session tokens, saved passwords, clipboard contents
56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Python-based infostealer packaged with PyInstaller. It steals browser passwords, Discord tokens, cryptocurrency wallets, cookies, and screenshots, then exfiltrates data via Telegram Bot API or HTTP POST. The content describes multilayer obfuscation, including AES-GCM-encrypted payloads, anti-sandbox checks, and persistence via Registry Run Keys.
BlankGrabber is an infostealer used in a multi-stage Rust and Python attack chain. It performs anti-analysis checks, profiles victims, enumerates saved Wi-Fi profiles, steals credentials and autofill data from Firefox and Chromium databases, targets cryptocurrency wallet extensions and applications such as Telegram, Roblox, Discord, and Steam, and disables Windows Defender protections while using a registry-based UAC bypass for privilege escalation and persistence.
Python-based information stealer with a modular, multi-stage delivery chain. It steals browser credentials, session tokens, saved passwords, clipboard contents, Wi-Fi passwords, cryptocurrency wallet data, screenshots, and webcam snapshots; it also disables Windows Defender protections, modifies the hosts file, and establishes persistence via the startup folder.
Python-based information stealer that performs anti-VM checks, creates a mutex, attempts to gain admin rights, disables or excludes itself from Microsoft Defender, and steals browser data, Discord data, Telegram data, crypto wallet data, Wi-Fi passwords, screenshots, webcam captures, system information, and selected files before exfiltrating the data to C2 via Discord webhooks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.