BlankGrabber Stealer Uses Fake Certificate Loader to Hide Malware Delivery Chain

The article discusses a new malware variant called BlankGrabber, which employs sophisticated techniques to evade detection and deliver malicious payloads. Here are the key points:

1. Malware Variant: The malware is named "BlankGrabber" and is a type of stealer that targets various credentials and sensitive information from infected systems.

2. Delivery Method:

   • BlankGrabber uses certutil.exe, a legitimate Windows utility, to decode base64-encoded data.
   • This method helps evade detection by security tools as the malware appears to be performing a standard certificate-related operation.

3. Execution Process:

   • The malware is initially delivered via WinRAR archives containing malicious files.
   • Once executed, it uses certutil.exe to decode non-certificate data and then runs PowerShell commands to disable Windows Defender.

4. Persistence Mechanisms:

   • BlankGrabber creates a scheduled task to ensure persistence on the infected system.
   • It also modifies DNS settings to redirect traffic through malicious servers or file-sharing services.

5. Data Exfiltration:

   • The malware collects sensitive information and sends it to Telegram's API or other known file-sharing sites.
   • This helps in maintaining command-and-control

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.