blankgrabber | codex[.]exe_

Resubmissions

01/07/2026, 06:45

260701-hjekcsgt8r

01/07/2026, 06:45

260701-hjb48sgt8q

01/07/2026, 03:29

260701-d2dnkaft9110

Sharing

Copy URL Twitter E-mail

Reason

scan timeout

General

Target
codex.exe_
Size 308.0MB
Sample260701-d2dnkaft91
SHA256 d0021501d2779b6cd3daf292308fceccee009002e62c9e93977cace7d4c52535
MD5 94916aeb4c8dd01422199aa1124fc3d9
SHA1 9b7372f437cebb19871e9223520c8096f07a978a
SHA512 fac2e32433fc2d92e1f44a14a87571b141cc33a3c41f113e38168c1700de3abd0ad8736b973a4f5d6e52b9983fdd2ab2db71122f5b39bb7ef6510d2e6b49fc62
SSDEEP 786432:CIzBXLIQFOyQXmy16qbg4GQ4ZXs72SRWEpuGNrtpygKqM3EYdfb3iG4bJy73Wf16:pBMQm1NbgG4ZnupmgM3EHcd8N0M38U
TLSH
T172F8F7116A9F99ADD1AAC870C38A4B335E2134CB1B35B9FF44D856313F7EAB45A38314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer blankgrabber

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
sample	blankgrabber_exe

File Explorer

codex.exe_

.exe 308.0MB

codex.exe_

IMPHASH 3ddf55fa4f8e2d1916d280169e73db65
SHA256 d0021501d2779b6cd3daf292308fceccee009002e62c9e93977cace7d4c52535
MD5 94916aeb4c8dd01422199aa1124fc3d9
SHA1 9b7372f437cebb19871e9223520c8096f07a978a
SHA512 fac2e32433fc2d92e1f44a14a87571b141cc33a3c41f113e38168c1700de3abd0ad8736b973a4f5d6e52b9983fdd2ab2db71122f5b39bb7ef6510d2e6b49fc62
SSDEEP 786432:CIzBXLIQFOyQXmy16qbg4GQ4ZXs72SRWEpuGNrtpygKqM3EYdfb3iG4bJy73Wf16:pBMQm1NbgG4ZnupmgM3EHcd8N0M38U
TLSH
T172F8F7116A9F99ADD1AAC870C38A4B335E2134CB1B35B9FF44D856313F7EAB45A38314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

A stealer written in Python and packaged with Pyinstaller

Digest

19:a4:65:03:bd:16:8c:f6:f2:60:f0:93:b4:d7:54:50:df:28:a6:6c:68:f1:cf:79:82:34:50:2c:90:c8:9e:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

Chains

Jun 26, 2026

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

Serial Number

33:00:02:57:9f:b3:7b:53:68:ed:ca:a1:f3:00:00:00:02:57:9f

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2026 - Jun 28, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:24:d3:95:e0:a2:e9:c9:31:00:00:00:00:00:57

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

231183360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI CancelIo CancelIoEx CancelSynchronousIo CloseHandle CompareStringOrdinal CompareStringW ConnectNamedPipe CopyFileExW CreateConsoleScreenBuffer CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateIoCompletionPort CreateMutexA CreateMutexW CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateSymbolicLinkW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushConsoleInputBuffer FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetBinaryTypeW GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetConsoleScreenBufferInfoEx GetCurrencyFormatEx GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatEx GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetGeoInfoW GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeInfo GetNamedPipeServerProcessId GetNativeSystemInfo GetNumberFormatEx GetNumberOfConsoleInputEvents GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempFileNameA GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTimeFormatEx GetTimeFormatW GetTimeZoneInformation GetTimeZoneInformationForYear GetUserDefaultLCID GetUserGeoID GetUserPreferredUILanguages GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapQueryInformation HeapReAlloc HeapSize HeapValidate InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MapViewOfFileEx MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus PowerClearRequest PowerCreateRequest PowerSetRequest QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleInputW ReadConsoleW ReadDirectoryChangesW ReadFile ReadFileEx RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResizePseudoConsole ResolveLocaleName ResumeThread RtlAddFunctionTable RtlCaptureContext RtlCaptureStackBackTrace RtlDeleteFunctionTable RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleActiveScreenBuffer SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetStdHandle SetThreadPriority SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

bcryptprimitives

ProcessPrng

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateProcessWithLogonW CreateRestrictedToken CreateWellKnownSid CredDeleteW CredFree CredReadW CredWriteW EqualSid EventRegister EventSetInformation EventWriteTransfer FreeSid GetAce GetAclInformation GetLengthSid GetNamedSecurityInfoW GetSecurityInfo GetTokenInformation GetUserNameW ImpersonateAnonymousToken IsWellKnownSid LookupAccountNameW LookupPrivilegeValueW MapGenericMask OpenProcessToken OpenThreadToken RegCloseKey RegCreateKeyExW RegCreateKeyTransactedW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyTransactedW RegQueryInfoKeyW RegQueryValueExW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo SetTokenInformation SystemFunction036

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

oleaut32

GetErrorInfo SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

combase

CoIncrementMTAUsage CoTaskMemFree

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

user32

CloseClipboard CloseDesktop CreateDesktopW EmptyClipboard GetClipboardData GetForegroundWindow GetKeyboardLayout GetSystemMetrics GetWindowThreadProcessId IsClipboardFormatAvailable OpenClipboard RegisterClipboardFormatW SetClipboardData ToUnicodeEx

shell32

DragQueryFileW SHGetKnownFolderPath ShellExecuteExW

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown socket

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle GetUserNameExW InitializeSecurityContextW QueryContextAttributesW

shlwapi

AssocQueryStringW

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertAddEncodedCertificateToStore CertCloseStore CertCreateCertificateChainEngine CertCreateCertificateContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetEnhancedKeyUsage CertOpenStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy CertVerifyTimeValidity CryptStringToBinaryA CryptUnprotectData

userenv

GetUserProfileDirectoryW

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen

winmm

timeGetTime

dbghelp

StackWalk64 SymFromAddr SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

CrashForExceptionInNonABICompliantCodeRange OnigDefaultCaseFoldFlag OnigDefaultSyntax OnigEncodingASCII OnigEncodingUTF8 OnigSyntaxOniguruma OnigSyntaxRuby aws_lc_0_39_0_jent_entropy_collector_alloc aws_lc_0_39_0_jent_entropy_collector_free aws_lc_0_39_0_jent_entropy_init aws_lc_0_39_0_jent_entropy_init_ex aws_lc_0_39_0_jent_entropy_switch_notime_impl aws_lc_0_39_0_jent_read_entropy aws_lc_0_39_0_jent_read_entropy_safe aws_lc_0_39_0_jent_set_fips_failure_callback aws_lc_0_39_0_jent_version onig_builtin_cmp onig_builtin_count onig_builtin_error onig_builtin_fail onig_builtin_max onig_builtin_mismatch onig_builtin_skip onig_builtin_total_count onig_callout_tag_is_exist_at_callout_num onig_copy_encoding onig_end onig_error_code_to_str onig_foreach_name onig_free onig_free_body onig_free_match_param onig_free_match_param_content onig_get_arg_by_callout_args onig_get_args_num_by_callout_args onig_get_callback_each_match onig_get_callout_data onig_get_callout_data_by_callout_args onig_get_callout_data_by_callout_args_self onig_get_callout_data_by_callout_args_self_dont_clear_old onig_get_callout_data_by_tag onig_get_callout_data_by_tag_dont_clear_old onig_get_callout_data_dont_clear_old onig_get_callout_in_by_callout_args onig_get_callout_name_by_name_id onig_get_callout_num_by_callout_args onig_get_callout_num_by_tag onig_get_callout_tag_end onig_get_callout_tag_start onig_get_capture_range_in_callout onig_get_capture_tree onig_get_case_fold_flag onig_get_contents_by_callout_args onig_get_contents_end_by_callout_args onig_get_current_by_callout_args onig_get_default_case_fold_flag onig_get_encoding onig_get_match_stack_limit_size onig_get_name_id_by_callout_args onig_get_options onig_get_parse_depth_limit onig_get_passed_args_num_by_callout_args onig_get_progress_callout onig_get_regex_by_callout_args onig_get_retraction_callout onig_get_retry_counter_by_callout_args onig_get_retry_limit_in_match onig_get_retry_limit_in_search onig_get_right_range_by_callout_args onig_get_start_by_callout_args onig_get_string_by_callout_args onig_get_string_end_by_callout_args onig_get_subexp_call_limit_in_search onig_get_subexp_call_max_nest_level onig_get_syntax onig_get_used_stack_size_in_callout onig_initialize onig_initialize_encoding onig_initialize_match_param onig_is_error_code_needs_param onig_match onig_match_with_param onig_name_to_backref_number onig_name_to_group_numbers onig_new onig_new_match_param onig_noname_group_capture_is_active onig_number_of_capture_histories onig_number_of_captures onig_number_of_names onig_reg_init onig_region_clear onig_region_copy onig_region_free onig_region_init onig_region_new onig_region_resize onig_region_set onig_regset_add onig_regset_free onig_regset_get_regex onig_regset_get_region onig_regset_new onig_regset_number_of_regex onig_regset_replace onig_regset_search onig_regset_search_with_param onig_scan onig_search onig_search_with_param onig_set_callback_each_match onig_set_callout_data onig_set_callout_data_by_callout_args onig_set_callout_data_by_callout_args_self onig_set_callout_data_by_tag onig_set_callout_of_name onig_set_callout_user_data_of_match_param onig_set_capture_num_limit onig_set_default_case_fold_flag onig_set_match_stack_limit_size onig_set_match_stack_limit_size_of_match_param onig_set_parse_depth_limit onig_set_progress_callout onig_set_progress_callout_of_match_param onig_set_retraction_callout onig_set_retraction_callout_of_match_param onig_set_retry_limit_in_match onig_set_retry_limit_in_match_of_match_param onig_set_retry_limit_in_search onig_set_retry_limit_in_search_of_match_param onig_set_subexp_call_limit_in_search onig_set_subexp_call_max_nest_level onig_set_verb_warn_func onig_set_warn_func onig_setup_builtin_monitors_by_ascii_encoded_name onig_unicode_define_user_property onigenc_get_default_encoding onigenc_get_left_adjust_char_head onigenc_get_prev_char_head onigenc_get_right_adjust_char_head onigenc_get_right_adjust_char_head_with_prev onigenc_init onigenc_is_valid_mbc_string onigenc_set_default_caseconv_table onigenc_set_default_encoding onigenc_step_back onigenc_str_bytelen_null onigenc_strdup onigenc_strlen onigenc_strlen_null tree_sitter_bash

Name

.text

Size

223.9MB

Virtual Size

223.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73.8MB

Virtual Size

73.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

415KB

Virtual Size

590KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

561KB

Virtual Size

560KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

Errors

General

Malware Config

Signatures

File Explorer

codex.exe_

kernel32

bcryptprimitives

advapi32

ntdll

oleaut32

api-ms-win-core-synch-l1-2-0

combase

api-ms-win-core-winrt-l1-1-0

user32

shell32

ws2_32

secur32

shlwapi

bcrypt

crypt32

userenv

iphlpapi

winhttp

winmm

dbghelp

generic