Fallout in dotnet, Aug 17 – Aug 23

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

FRIDAY

Fri Aug 21 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticmicro-behaviors/datamicro-behaviors/cryptoobjectivesobjectives/command-and-controlobjectives/evasionmicro-behaviors/process+4 34d
ArgutrackDNN.Runtime 2.0.260802 dotnet 8,312 installs 34 days ago

Reactor-packed encrypted payload loader

hidden/executionstaging/embedded

WEDNESDAY

Wed Aug 19 · 1 catch · 0 waves · 1 single
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/archobjectives/command-and-controlobjectivesobjectives/anti-staticobjectives/evasionmetadata/binary+10 35d
Sorcha.Cli 2.73.1 dotnet 4,680 installs 35 days ago

Hostile PE layout with VirtualProtect

obfuscation/importsmasquerade/binary
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories