🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlankGrabber


Vendor detections: 9


Intelligence 9 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded
SHA3-384 hash: 69c652f37ec669a4425d06e36fd3ed562f4f52afdb1841e37b77e0559c94fee2fa5dcb30d4cac37cff61c5c6bf8f1296
SHA1 hash: fe72742911ad8c9b31ba17dce3ffcb568b4e7457
MD5 hash: b405dca14b7b93b0cfa4cf0173f037e9
humanhash: vegan-moon-purple-blue
File name:stub.py
Download: download sample
Signature BlankGrabber
Create hunting rule
File size:88'623 bytes
First seen:2026-10-14 15:47:32 UTC
Last seen:Never
File type:py py
MIME type:text/x-script.python
ssdeep 1536:GKYbFNbqPDxK3fF0USPUJvUrViwBjNjXZELqDOqokprthEcfn:GtRNbqPK0UScJvUrViwNBXZENqokprtv
TLSH T13F83EA2ADD16292683D7D3912E4585C2371CED67871628307DEC52582F0DEB4C3FAAED
Magika python
Reporter NyxIndius
Tags:BlankGrabber py

Intelligence

File Origin
# of uploads :
1
# of downloads :
29
Origin country :
BR BR
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad15ed3f4e17c78f715fcd0
Tags:
vmdetect
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm base64 fingerprint obfuscated obfuscated python smb stealer stealer
Link:
https://www.filescan.io/uploads/6acfaa325fe91cc0f603765d/reports/5d6130af-880b-4a46-95b5-a3978d00cbc7/overview
Verdict:
Malicious
Labled as:
PY.STEALER.B.Generic
Link:
https://www.hybrid-analysis.com/sample/dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded
Verdict:
Malicious
File Type:
text
Detections:
Trojan.Script.Poweliks.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Stealer.sb
Link:
https://opentip.kaspersky.com/dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded/results?tab=lookup
Score:
49%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded/
Threat name:
Script-Python.Trojan.Grabber
Create hunting rule
Status:
Malicious
First seen:
2025-05-28 17:58:33 UTC
File Type:
Text (Python)
AV detection:
11 of 38 (28.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3rwiguey74a664vqker7wftevie7tv65gok7mhxi5oyaduplpxwq._file
Result
Malware family:
blankgrabber
Create hunting rule
Score:
  10/10
Tags:
family:blankgrabber execution stealer
Link:
https://tria.ge/reports/261014-tpbw7sfw4w/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dc6c835098ff01ef72b05123fb1664aa09f9d7dd3395f61ee8ebb001d1eb7ded

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:MALW_JS_PirateStealerPKG
Create hunting rule
Author:skyeto
Description:PirateStealer Malware
Reference:https://twitter.com/skyetothefox/status/1444442313367998467
Rule name:OBFUS_PowerShell_Common_Replace
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the common usage of replace for obfuscation
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_Script_PowerShell_Hidden_Launcher
Create hunting rule
Author:Marjoriefort
Description:Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:Veille fraicheur 2026-09-14 / cluster misses web
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_rule_vldslv
Create hunting rule
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments