Fallout in windows, Jul 27 – Aug 2

What we caught this week while monitoring over 176,053,698 artifacts across 48 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 2 · 2 catches · 0 waves · 2 singles
micro-behaviorsmicro-behaviors/communicationsmetadata/binarymetadataobjectives/anti-staticobjectives/privilege-escalationmicro-behaviors/fsmicro-behaviors/hardwareobjectives/evasionobjectives/collectionobjectives+8 55d
ussf windows 55 days ago

keylogger, screen capture, process injection

keylog/capturefile/script
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-analysisobjectives/anti-staticmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/dataobjectivesobjectives/collection+6 56d
the-sz.Trion windows 56 days ago

Trion RAT malware with exfiltration

screenshot/capture

SATURDAY

Sat Aug 1 · 11 catches · 0 waves · 3 singles
objectivesobjectives/anti-staticmicro-behaviors/datamicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlmicro-behaviors/osmicro-behaviors/processmicro-behaviors/fsmicro-behaviors/mem+2 56d
ccenhancer.install windows 56 days ago

Inno Setup installer with DLL sideloading

micro-behaviorsmicro-behaviors/communicationsmetadata/binarymetadatamicro-behaviors/osmicro-behaviors/processmicro-behaviors/datamicro-behaviors/fsmicro-behaviors/memmicro-behaviors/uimetadata/signed+1 56d
SCSetup windows 56 days ago

High-entropy overlay suggests embedded malicious payload

micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/collectionmicro-behaviors/osmicro-behaviors/fsmicro-behaviors/processobjectivesobjectives/command-and-controlobjectives/exfiltration+8 56d
ynjmxn.Gengchou windows 56 days ago

DPAPI stealer with loader tradecraft

loader/evasivecredential/platform

FRIDAY

Fri Jul 31 · 1 catch · 0 waves · 1 single
objectivesobjectives/anti-staticmicro-behaviors/datamicro-behaviorsmetadata/binarymetadataobjectives/collectionobjectives/command-and-controlobjectives/impactmicro-behaviors/osmicro-behaviors/process+5 57d
FreePlane windows 57 days ago

Installer contains DLL sideloading and obfuscated payload

WEDNESDAY

Wed Jul 29 · 11 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticobjectives/evasionobjectives/credential-accessobjectives/lateral-movementobjectives/command-and-controlobjectivesobjectives/impact+7 59d
8b77fb002e30… windows 59 days ago

Ransomware extortion and C2

channel/emailransom/extortion
well-knownwell-known/appmicro-behaviors/fsmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/exfiltrationmetadata/package+15 59d
cc21168e7a28… windows 59 days ago

PyArmor-protected stealer with embedded RAR

stealer/packagestaging/embedded
well-knownwell-known/appmicro-behaviors/fsmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticobjectives/command-and-controlobjectivesobjectives/exfiltrationmetadata/package+15 59d
44df3b2362ca… windows 59 days ago

PyArmor, RAR payload, evasion

staging/embeddedstealer/package

MONDAY

Mon Jul 27 · 3 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmalwaremalware/libraryobjectives/anti-staticobjectives/executionmicro-behaviors/osmetadata/binarymetadataobjectivesobjectives/collection+8 61d
cute-cw windows 61 days ago

QtGui4.dll contains keylogger and RCE capabilities

keylog/capturesection/metrics
objectivesobjectives/discoverymicro-behaviors/communicationsmicro-behaviorsmetadatametadata/packageobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processmicro-behaviors/time 61d
undo-winrmconfig-during-shutdown windows 61 days ago

Downloads and executes remote PowerShell script

well-knownwell-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlobjectives/impactmicro-behaviors/cryptoobjectivesobjectives/credential-access+5 61d
TJSmith.Anodizer 0.25.0-windows-arm64 windows 61 days ago

Contains EDR killer and credential harvesting

secrets/bulk-access
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories