BlueNorOff is described as using ProcessRequest, a macOS malware sample aimed at cryptocurrency related targets such as exchanges, venture capital firms, and banks. The sample is temporarily signed and operates as a simple Objective-C remote shell that can run commands received from the attacker server. The source notes that the malware splits command and control URL strings to hinder static detection and references SwissBorg themed infrastructure as part of the analysis. Hashes for the ProcessRequest sample are provided, including SHA-256 8bfa4fe0534c0062393b6a2597c3491f7df3bf2eabfe06544c53bdf1f38db6d4.