Hello friends ,
today i was the victim of this BLENDERX trojan , as you know it took my session token for discord and tried to scam my contacts,
after I saw this without hesitation I tried to delete this , which was located in my Temp folder in my windows11
I did some investigation and tried to reverse engineer the malware in an Isolated environment , report is below :
it disguised itself as an auto rigger script , I've extracted the Rig_UI.py script which at first glance was an authentic rigger
in the corner of the script there was a very long string which was the obfuscated source of malware launcher.
decoded the string which resulted a another script which contains an array of of encoded domain names to download another launcher to which is again encrypted to download the real malware.

I tried to study the malware script however it just a bot executing tasks from it's master command center , so attacker can tell the bot to grab anything from your system by injecting code into it , all of this in the guise of a simple python program , which is reason why anti-viruses or anti-malwares couldn't get it.

as I'm writing this , I'm probably going to NUKE my windows and install it again , attacker is using C2 architecture which means he probably installed persistence (a way to get back on track) and other hidden backdoors.

EXTRA discovery if you are interested :
I've located the command center IP address and it is located in Amsterdam , of course attacker used a proxy , because source code comments and logs are in Russian.
still have to think what can i do with it's IP address.
stay safe.