(3 months ago)ricksanchz Wrote:
The file path alone gives it away:
.
Blank Grabber is a well-known, publicly-documented information stealer / trojan builder. It's a "grabber" tool designed to steal saved browser passwords, cookies, Discord tokens, crypto wallet data, and other credentials from a victim's machine, then exfiltrate them (typically via Discord webhooks or similar).
Specific red flags in this exact
file:
- It launches — a
(shortcut) file disguised inside a
folder, a classic persistence/obfuscation trick to make a malicious payload look like an innocuous Python cache file.
- It sets up a Python environment specifically to run from a "Grabber" builder — this is the tool used to generate customized stealer payloads.
- The library checks (,
, etc.) are typical of a stealer that encrypts stolen data and sends it over HTTP.
