Navigation

8Ball Open source builder [ALPHA]

posted by ricksanchz and Last Post: 1 hour ago


RELEASE 8Ball Open source builder [ALPHA]  693
Virustotal Link(Required)
p4nd4 Junior Member
2
Posts
0
Threads
Junior Member
#2
(3 months ago)ricksanchz Wrote:  
The file path alone gives it away:
Code:
Blank-Grabber-main
. Blank Grabber is a well-known, publicly-documented information stealer / trojan builder. It's a "grabber" tool designed to steal saved browser passwords, cookies, Discord tokens, crypto wallet data, and other credentials from a victim's machine, then exfiltrate them (typically via Discord webhooks or similar).
Specific red flags in this exact
Code:
.bat
file:
  • It launches
    Code:
    pycache.lnk
    — a
    Code:
    .lnk
    (shortcut) file disguised inside a
    Code:
    __pycache__
    folder, a classic persistence/obfuscation trick to make a malicious payload look like an innocuous Python cache file.
  • It sets up a Python environment specifically to run
    Code:
    gui.py
    from a "Grabber" builder — this is the tool used to generate customized stealer payloads.
  • The library checks (
    Code:
    pyaes
    ,
    Code:
    urllib3
    , etc.) are typical of a stealer that encrypts stolen data and sends it over HTTP.

Reply


Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
or
Sign in
Already have an account? Sign in here.


Users browsing this thread: 4 Guest(s)