SOC Prime Bias: Medium

07 Apr 2026 18:22
newspaper icon Splunk

The Certificate Decoding Illusion: How Blank Grabber Stealer Hides Its Loader

Author Photo
SOC Prime Team linkedin icon Follow
The Certificate Decoding Illusion: How Blank Grabber Stealer Hides Its Loader
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

BlankGrabber is a Python-based infostealer that starts with a batch-script loader which “decodes” a Rust-compiled stager masquerading as a certificate file. The stager performs sandbox and VM checks, decrypts an embedded payload, and drops multiple malicious components, including an XWorm client and a PyInstaller-packed stealer. Exfiltration relies on public web services such as Telegram bot APIs and IP-look-up endpoints to blend with normal traffic. The malware also tampers with system settings, blocks access to security sites, and attempts UAC bypass to strengthen persistence.

Investigation

The Splunk Threat Research Team analyzed the initial loader delivered via gofile.io, its use of certutil.exe for payload decoding, and the Rust stager’s anti-analysis logic. They reverse engineered the AES-GCM/CTR decryption flow, extracted an embedded ZIP archive, and mapped the resulting payload set. Behavioral testing showed broad host discovery, webcam capture, clipboard harvesting, and theft of host keys and other sensitive artifacts.

Mitigation

Monitor for suspicious certutil.exe usage, PowerShell commands that alter Windows Defender preferences, and unauthorized edits to the hosts file. Alert on WinRAR/rar.exe execution from non-standard paths and DNS lookups to Telegram API or known IP-look-up services. Block known malicious filenames and constrain execution of unsigned PyInstaller-bundled Python binaries through application control policies.

Response

If indicators are detected, isolate the endpoint, preserve volatile evidence, and capture the %TEMP% directory for forensic review. Remove malicious scheduled tasks or registry Run entries, revert any hosts-file modifications, and reset Windows Defender exclusions. Perform a full credential reset for potentially exposed browser credentials and crypto wallet data.

"graph TB %% Class definitions classDef technique fill:#e6f7ff classDef operator fill:#ffcc66 classDef data fill:#d9ead3 %% Nodes u2013 Techniques init_exec["<b>Technique</b> – T1059.003: Windows Command Shell<br/><b>Description</b>: Batch script runs certutil to decode embedded Rust stager"] class init_exec technique evasion_vm["<b>Technique</b> – T1497: Virtualization/Sandbox Evasion<br/><b>Description</b>: Checks drivers, usernames and UUIDs to detect analysis environments"] class evasion_vm technique obfuscation["<b>Technique</b> – T1027: Obfuscated Files or Information<br/><b>Description</b>: Rust executable is disguised as a certificate file"] class obfuscation technique decode["<b>Technique</b> – T1140: Deobfuscate/Decode Files or Information<br/><b>Description</b>: AESu2011CTR/GCM decryption of the encrypted payload (blank.aes)"] class decode technique load_stager["<b>Technique</b> – T1105: Ingress Tool Transfer<br/><b>Description</b>: Drops a randomlyu2011named executable into %TEMP% and launches it"] class load_stager technique pers_startup["<b>Technique</b> – T1037.005: Boot or Logon Initialization Scripts (Startup Folder)"] class pers_startup technique elev_uac["<b>Technique</b> – T1548.002: Abuse Elevation Control Mechanism (Registry UAC bypass)"] class elev_uac technique impair_def["<b>Technique</b> – T1562.004: Impair Defenses (Disable Windows Defender, add exclusion)"] class impair_def technique hide_hosts["<b>Technique</b> – T1564.012: Hide Artifacts (Modify hosts file to block security sites)"] class hide_hosts technique data_collection["<b>Technique</b> – T1082: System Information Discovery and related gathering"] class data_collection data sysinfo["<b>Technique</b> – T1082: System Information Discovery"] class sysinfo technique browser_info["<b>Technique</b> – T1217: Browser Information Discovery"] class browser_info technique clipboard["<b>Technique</b> – T1115: Clipboard Data"] class clipboard technique video_capture["<b>Technique</b> – T1125: Video Capture"] class video_capture technique wifi_passwords["<b>Technique</b> – T1016: System Network Configuration Discovery (Wiu2011Fi passwords)"] class wifi_passwords technique product_key["<b>Technique</b> – T1012: Query Registry (Windows product key)"] class product_key technique removable_media["<b>Technique</b> – T1025: Data from Removable Media"] class removable_media technique wmi_queries["<b>Technique</b> – T1047: Windows Management Instrumentation (System queries)"] class wmi_queries technique archive_data["<b>Technique</b> – T1560.001: Archive Collected Data (RAR utility)"] class archive_data technique exfil_telegram["<b>Technique</b> – T1041: Exfiltration Over C2 Channel (Telegram bot API)"] class exfil_telegram technique exfil_public["<b>Technique</b> – T1048: Exfiltration Over Alternative Protocol (Public fileu2011sharing services)"] class exfil_public technique self_delete["<b>Technique</b> – T1070: Indicator Removal (Selfu2011deletion after exfiltration)"] class self_delete technique %% Flow connections init_exec –>|leads_to| evasion_vm evasion_vm –>|leads_to| obfuscation obfuscation –>|leads_to| decode decode –>|leads_to| load_stager load_stager –>|enables| pers_startup load_stager –>|enables| elev_uac load_stager –>|enables| impair_def load_stager –>|enables| hide_hosts load_stager –>|starts| data_collection data_collection –>|includes| sysinfo data_collection –>|includes| browser_info data_collection –>|includes| clipboard data_collection –>|includes| video_capture data_collection –>|includes| wifi_passwords data_collection –>|includes| product_key data_collection –>|includes| removable_media data_collection –>|includes| wmi_queries data_collection –>|leads_to| archive_data archive_data –>|uses| exfil_telegram archive_data –>|uses| exfil_public exfil_telegram –>|followed_by| self_delete exfil_public –>|followed_by| self_delete "

Attack Flow

Detections

Privilege Escalation (UAC bypass) via FodHelper (via cmdline)

SOC Prime Team
02 Apr 2026

View

Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via cmdline)

SOC Prime Team
02 Apr 2026

View

Possible Data Infiltration / Exfiltration / C2 via Third Party Services / Tools (via proxy)

SOC Prime Team
02 Apr 2026

View

Potential Captured Data Staging In Temp Folder (via file_event)

SOC Prime Team
02 Apr 2026

View

Possible System Enumeration (via cmdline)

SOC Prime Team
02 Apr 2026

View

Environment Path Changes (via registry_event)

SOC Prime Team
02 Apr 2026

View

Possible PING Usage for Delay Execution (via cmdline)

SOC Prime Team
02 Apr 2026

View

Suspicious Operations on Ms-settings Regsistry Key (via cmdline)

SOC Prime Team
02 Apr 2026

View

Using Certutil for Data Encoding and Cert Operations (via cmdline)

SOC Prime Team
02 Apr 2026

View

Possible Wifi Password Discovery (via cmdline)

SOC Prime Team
02 Apr 2026

View

Environment Variables in Command Line Arguments (via cmdline)

SOC Prime Team
02 Apr 2026

View

Possible Data Infiltration / Exfiltration / C2 via Third Party Services / Tools (via dns)

SOC Prime Team
02 Apr 2026

View

Possible System Network Configuration Discovery (via cmdline)

SOC Prime Team
02 Apr 2026

View

Possible Antivirus or Firewall Software Enumeration (via process_creation)

SOC Prime Team
02 Apr 2026

View

Windows Defender Preferences Suspicious Changes (via powershell)

SOC Prime Team
02 Apr 2026

View

Disable Windows Defender Realtime Monitoring (via powershell)

SOC Prime Team
02 Apr 2026

View

Suspicious Binary / Scripts in Autostart Location (via file_event)

SOC Prime Team
02 Apr 2026

View

Possible IP Lookup Domain Communications Attempted (via dns)

SOC Prime Team
02 Apr 2026

View

Disable Windows Defender Realtime Monitoring and Other Preferences Changes (via cmdline)

SOC Prime Team
02 Apr 2026

View

IOCs (HashSha256) to detect: The Certificate Decoding Illusion: How Blank Grabber Stealer Hides Its Loader

SOC Prime AI Rules
02 Apr 2026

View

Detection of BlankGrabber C2 Communications via DNS Queries [Windows Sysmon]

SOC Prime AI Rules
02 Apr 2026

View

Detect BlankGrabber PowerShell Activity [Windows Powershell]

SOC Prime AI Rules
02 Apr 2026

View

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    The adversary, having compromised the endpoint with the BlankGrabber stealer, issues DNS queries to three distinct services used by the malware for C2 and reconnaissance:

    1. Telegram API domain – used to fetch commands via a Telegram bot. 
      Resolve-DnsName -Name api.telegram.org -Type A
    2. Public‑IP‑check service – obtains the victim’s external IP address for later exfiltration. 
      Resolve-DnsName -Name api.ipify.org -Type A
    3. Abused file‑sharing service – sends a small encoded data chunk via a sub‑domain of pastebin.com. 
      Resolve-DnsName -Name maliciouspayload.pastebin.com -Type A

    Each call is performed using PowerShell’s native Resolve-DnsName to ensure the DNS client logs are generated on the local host. The three queries map directly to the three selection_ blocks of the Sigma rule, guaranteeing a match.

  • Regression Test Script:

    # BlankGrabber DNS C2 Simulation – triggers detection rule
$domains = @(
    "api.telegram.org",
    "api.ipify.org",
    "maliciouspayload.pastebin.com"
)

foreach ($d in $domains) {
    Write-Host "Querying $d ..."
    try {
        Resolve-DnsName -Name $d -Type A -ErrorAction Stop | Out-Null
        Write-Host "✅ $d queried"
    } catch {
        Write-Warning "❌ Failed to query $d : $_"
    }
    Start-Sleep -Seconds 2   # slight delay to mimic realistic traffic
}

  • Cleanup Commands:

    # No persistent artifacts are created by Resolve-DnsName.
# Clear the DNS cache to remove any residual entries.
ipconfig /flushdns
Write-Host "DNS cache cleared."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free