Fallout in windows, Aug 10 – Aug 16

What we caught this week while monitoring over 167,269,545 artifacts across 46 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SATURDAY

Sat Aug 15 · 3 catches · 0 waves · 3 singles
objectives/command-and-controlmicro-behaviors/osmicro-behaviorsmalware/appmetadata/binarymalwaremetadataobjectives/anti-analysisobjectives/collectionobjectivesobjectives/evasion+29 41d
Psynect.OmniMend windows 41 days ago

EDR teardown, AMSI bypass, credential theft

platform/defenderanti-av/amsi
well-knownwell-known/Mcmicro-behaviors/fsmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticobjectives/evasionobjectives/command-and-controlobjectivesobjectives/impact+25 41d
AOMEI.PartitionAssistant windows 41 days ago

MBR wiper, destructive file wiper, stealer

staging/embeddeddestroy/file-deletion
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymalwaremalware/librarymetadataobjectives/command-and-controlobjectives/impactthird_partyobjectives/evasionobjectives+11 41d
iOfficeAI/OfficeCLI windows 41 days ago

Remote PowerShell cradle embedded

platform/defenderanti-av/amsi

FRIDAY

Fri Aug 14 · 2 catches · 0 waves · 2 singles
micro-behaviors/fsmicro-behaviorsmetadata/documentmalware/appmalwaremetadataobjectives/anti-staticobjectives/discoveryobjectives/command-and-controlobjectivesobjectives/evasion+25 42d
Microsoft.Gaming.GDK 3.7874 windows 42 days ago

AMSI bypass and PE injection

loader/native-reflectplatform/defender
micro-behaviors/communicationsmicro-behaviorsmalware/appmalwareobjectives/anti-staticobjectives/supply-chainobjectives/command-and-controlobjectives/persistenceobjectivesmetadata/packagemetadata+23 42d
Ferdium.Ferdium.Nightly windows 42 days ago

XSS injection in htmlescape package

login/xdgmanifest/name

THURSDAY

Thu Aug 13 · 2 catches · 0 waves · 2 singles
micro-behaviors/datamicro-behaviorsmetadata/binarymetadataobjectives/anti-staticobjectives/discoverymicro-behaviors/fsmicro-behaviors/osobjectivesobjectives/command-and-controlobjectives/collection+6 43d
FineprintSoftware.FinePrint windows 43 days ago

Keylogging and process injection APIs

keylog/captureexecution/masquerade-loader
micro-behaviorsmicro-behaviors/communicationsmetadata/binarymetadataobjectives/anti-staticobjectives/discoverymicro-behaviors/fsmicro-behaviors/osobjectives/collectionobjectivesobjectives/command-and-control+7 43d
FineprintSoftware.pdfFactory windows 43 days ago

COM dropper, keylogging, process injection

execution/masquerade-loaderkeylog/capture

TUESDAY

Tue Aug 11 · 2 catches · 0 waves · 2 singles
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticobjectives/evasionmicro-behaviors/cryptomicro-behaviors/datamicro-behaviors/fsobjectives/command-and-controlobjectives+7 45d
tinyrack.coder-cli windows 45 days ago

encoded temp command stager

staging/temp
well-knownwell-known/librarymicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/discoveryobjectives/privilege-escalationthird_partyobjectives/evasionobjectives+9 45d
laurentiu021.SysManager v1.60.0 windows 45 days ago

AMSI patch, self-extract, evasion

platform/defenderanti-av/amsi

MONDAY

Mon Aug 10 · 3 catches · 0 waves · 3 singles
micro-behaviors/cryptomicro-behaviorsmetadata/binarymetadatamicro-behaviors/osmicro-behaviors/processmicro-behaviors/datamicro-behaviors/fsobjectivesobjectives/anti-staticobjectives/command-and-control+3 46d
830a22ea4eb2… windows ✓ 46 days ago

Unsigned nested Inno payload with obfuscation

payload/encryptedexecution/installer
well-knownwell-known/toolmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/discoveryobjectives/executionobjectives/supply-chainobjectivesobjectives/persistence+7 46d
eMClient.eMClient windows 46 days ago

MSI creates local admin backdoor

account/createinstall-hook/setup
objectives/anti-staticwell-knownwell-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-analysisobjectivesobjectives/evasionmicro-behaviors/process+12 46d
TristanTang.AgentIsland 1.7.1-win-x64 windows 46 days ago

AMSI patch, thread hijack, unsigned

platform/defenderinjection/thread-hijacking
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories