329. Adversaries Use Blender 3D Files to Deliver Stealers
Hello everyone! I always love to see creative ways of malware delivery. Thie time adversaries leveraged malicious .blend files uploaded to free 3D assets sites. According to the report , embedded Python script fetched a loader from workers[.]dev URL, which is a PowerShell script. The script downloads two archives: one contains a Python environment with StealC, the other - a Python Stealer. So, what to hunt for? Some examples: - Execution of suspicious .blend files. - Communications with workers[.]dev initiated by suspicious processes. - Suspicious LNK files in the Startup folder. - Execution of suspicious Python scripts (Yes, they are, for example, ZalypaGyliveraV1.py). See you tomorrow!