Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\blitz\shell\open\command] '' = '"%LOCALAPPDATA%\Programs\Blitz\Blitz.exe" "%1"'
Malicious functions
Injects code into
the following user processes:
- blitz.exe
Modifies file system
Creates the following files
- %TEMP%\nsg4441.tmp\system.dll
- %LOCALAPPDATA%\programs\blitz\libegl.dll
- %LOCALAPPDATA%\programs\blitz\ffmpeg.dll
- %LOCALAPPDATA%\programs\blitz\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\blitz\blitz.exe
- %LOCALAPPDATA%\programs\blitz\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\blitz\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\blitz\snapshot_blob.bin
- %LOCALAPPDATA%\programs\blitz\resources\overlay\index.js.gz
- %LOCALAPPDATA%\programs\blitz\resources\overlay\index.js
- %LOCALAPPDATA%\programs\blitz\resources\overlay\index.html
- %LOCALAPPDATA%\programs\blitz\resources\binaries\index.node
- %LOCALAPPDATA%\programs\blitz\resources\binaries\electron_overlay.node
- %LOCALAPPDATA%\programs\blitz\resources\binaries\blitz_core.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\win32-ia32\node.napi.node
- %LOCALAPPDATA%\programs\blitz\resources\binaries\blitz-overlay.dll
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-x64\node.napi.musl.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-x64\node.napi.glibc.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-arm64\node.napi.armv8.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-arm\node.napi.armv7.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-arm\node.napi.armv6.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\darwin-x64\node.napi.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\android-arm64\node.napi.armv8.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\android-arm\node.napi.armv7.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar
- %LOCALAPPDATA%\programs\blitz\resources\app-update.yml
- %LOCALAPPDATA%\programs\blitz\resources\.env.production
- %LOCALAPPDATA%\programs\blitz\resources.pak
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\win32-x64\node.napi.node
- %LOCALAPPDATA%\programs\blitz\locales\nl.pak
- %LOCALAPPDATA%\programs\blitz\resources\binaries\injector_x64.exe
- %APPDATA%\blitz\blitz-deps\1.15.35\tft-internal.dll
- %APPDATA%\blitz\blitz-deps\1.15.35\safe_x86_injector.exe
- %APPDATA%\blitz\blitz-deps\1.15.35\safe_x64_injector.exe
- %APPDATA%\blitz\blitz-deps\1.15.35\pinmanager.exe
- %APPDATA%\blitz\blitz-deps\1.15.35\n_overlay.x64.dll
- %APPDATA%\blitz\blitz-deps\1.15.35\n_overlay.dll
- %APPDATA%\blitz\blitz-deps\1.15.35\native-utils.dll
- %APPDATA%\blitz\blitz-deps\1.15.35\injector_x64.exe
- %APPDATA%\blitz\blitz-deps\1.15.35\index.node
- %APPDATA%\blitz\blitz-deps\1.15.35\electron_overlay.node
- %APPDATA%\blitz\blitz-deps\1.15.35\blitz_core.node
- %APPDATA%\blitz\blitz-deps\1.15.35\blitz-overlay.dll
- %HOMEPATH%\desktop\blitz.lnk
- %LOCALAPPDATA%\programs\blitz\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\blitz\libglesv2.dll
- %LOCALAPPDATA%\programs\blitz\uninstall blitz.exe
- %LOCALAPPDATA%\blitz-updater\installer.exe
- %LOCALAPPDATA%\programs\blitz\vulkan-1.dll
- %LOCALAPPDATA%\programs\blitz\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\blitz\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\programs\blitz\swiftshader\libegl.dll
- %LOCALAPPDATA%\programs\blitz\resources\elevate.exe
- %LOCALAPPDATA%\programs\blitz\resources\binaries\tft-internal.dll
- %LOCALAPPDATA%\programs\blitz\resources\binaries\safe_x86_injector.exe
- %LOCALAPPDATA%\programs\blitz\resources\binaries\safe_x64_injector.exe
- %LOCALAPPDATA%\programs\blitz\resources\binaries\pinmanager.exe
- %LOCALAPPDATA%\programs\blitz\resources\binaries\n_overlay.x64.dll
- %LOCALAPPDATA%\programs\blitz\resources\binaries\n_overlay.dll
- %APPDATA%\microsoft\windows\start menu\programs\blitz.lnk
- %LOCALAPPDATA%\programs\blitz\resources\binaries\native-utils.dll
- %LOCALAPPDATA%\programs\blitz\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\blitz\locales\vi.pak
- %LOCALAPPDATA%\programs\blitz\locales\uk.pak
- %LOCALAPPDATA%\programs\blitz\locales\bg.pak
- %LOCALAPPDATA%\programs\blitz\locales\fi.pak
- %LOCALAPPDATA%\programs\blitz\locales\fa.pak
- %LOCALAPPDATA%\programs\blitz\locales\et.pak
- %LOCALAPPDATA%\programs\blitz\locales\es.pak
- %LOCALAPPDATA%\programs\blitz\locales\es-419.pak
- %LOCALAPPDATA%\programs\blitz\locales\en-us.pak
- %LOCALAPPDATA%\programs\blitz\locales\en-gb.pak
- %LOCALAPPDATA%\programs\blitz\locales\el.pak
- %LOCALAPPDATA%\programs\blitz\locales\de.pak
- %LOCALAPPDATA%\programs\blitz\locales\da.pak
- %LOCALAPPDATA%\programs\blitz\locales\cs.pak
- %LOCALAPPDATA%\programs\blitz\locales\ca.pak
- %APPDATA%\blitz\crashpad\settings.dat
- %LOCALAPPDATA%\programs\blitz\locales\fr.pak
- %LOCALAPPDATA%\programs\blitz\locales\ar.pak
- %LOCALAPPDATA%\programs\blitz\locales\am.pak
- %LOCALAPPDATA%\programs\blitz\licenses.chromium.html
- %LOCALAPPDATA%\programs\blitz\license.electron.txt
- %LOCALAPPDATA%\programs\blitz\icudtl.dat
- %LOCALAPPDATA%\programs\blitz\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\blitz\chrome_100_percent.pak
- %TEMP%\nsg4441.tmp\nsis7z.dll
- %TEMP%\nsg4441.tmp\app-32.7z
- %TEMP%\nsg4441.tmp\spiderbanner.dll
- %TEMP%\nsg4441.tmp\nsexec.dll
- %TEMP%\nsg4441.tmp\nsprocess.dll
- %TEMP%\nsg4441.tmp\stdutils.dll
- %LOCALAPPDATA%\programs\blitz\locales\bn.pak
- %TEMP%\nsg4441.tmp\winshell.dll
- %LOCALAPPDATA%\programs\blitz\locales\gu.pak
- %LOCALAPPDATA%\programs\blitz\locales\hr.pak
- %LOCALAPPDATA%\programs\blitz\locales\he.pak
- %LOCALAPPDATA%\programs\blitz\locales\tr.pak
- %LOCALAPPDATA%\programs\blitz\locales\th.pak
- %LOCALAPPDATA%\programs\blitz\locales\te.pak
- %LOCALAPPDATA%\programs\blitz\locales\ta.pak
- %LOCALAPPDATA%\programs\blitz\locales\sw.pak
- %LOCALAPPDATA%\programs\blitz\locales\sv.pak
- %LOCALAPPDATA%\programs\blitz\locales\sr.pak
- %LOCALAPPDATA%\programs\blitz\locales\sl.pak
- %LOCALAPPDATA%\programs\blitz\locales\sk.pak
- %LOCALAPPDATA%\programs\blitz\locales\ru.pak
- %LOCALAPPDATA%\programs\blitz\locales\ro.pak
- %LOCALAPPDATA%\programs\blitz\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\blitz\locales\hi.pak
- %LOCALAPPDATA%\programs\blitz\locales\pt-br.pak
- %LOCALAPPDATA%\programs\blitz\locales\fil.pak
- %LOCALAPPDATA%\programs\blitz\locales\nb.pak
- %LOCALAPPDATA%\programs\blitz\locales\ms.pak
- %LOCALAPPDATA%\programs\blitz\locales\mr.pak
- %LOCALAPPDATA%\programs\blitz\locales\ml.pak
- %LOCALAPPDATA%\programs\blitz\locales\lv.pak
- %LOCALAPPDATA%\programs\blitz\locales\lt.pak
- %LOCALAPPDATA%\programs\blitz\locales\ko.pak
- %LOCALAPPDATA%\programs\blitz\locales\kn.pak
- %LOCALAPPDATA%\programs\blitz\locales\ja.pak
- %LOCALAPPDATA%\programs\blitz\locales\it.pak
- %LOCALAPPDATA%\programs\blitz\locales\id.pak
- %LOCALAPPDATA%\programs\blitz\locales\hu.pak
- %LOCALAPPDATA%\programs\blitz\locales\pl.pak
- %APPDATA%\blitz\fontlookuptablecache\font_unique_name_table.pb
Deletes the following files
- %TEMP%\nsg4441.tmp\app-32.7z
- %TEMP%\nsg4441.tmp\nsexec.dll
- %TEMP%\nsg4441.tmp\nsis7z.dll
- %TEMP%\nsg4441.tmp\nsprocess.dll
- %TEMP%\nsg4441.tmp\spiderbanner.dll
- %TEMP%\nsg4441.tmp\stdutils.dll
- %TEMP%\nsg4441.tmp\system.dll
- %TEMP%\nsg4441.tmp\winshell.dll
Network activity
Connects to
- 'ut###.iesdev.com':443
UDP
- DNS ASK ut###.iesdev.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Blitz'
Creates and executes the following
- '%LOCALAPPDATA%\programs\blitz\blitz.exe'
- '%LOCALAPPDATA%\programs\blitz\blitz.exe' --type=crashpad-handler --user-data-dir=%APPDATA%\Blitz /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=%APPDATA%\Blitz\Crashpad --url=https://sentry.bli...
- '%LOCALAPPDATA%\programs\blitz\blitz.exe' --type=gpu-process --field-trial-handle=1304,12762329781608545292,11544918599091155130,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCoo...
- '%LOCALAPPDATA%\programs\blitz\blitz.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1304,12762329781608545292,11544918599091155130,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,H...
