Fallout in windows, Aug 17 – Aug 23

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 23 · 3 catches · 0 waves · 3 singles
well-known/appwell-knownmicro-behaviors/osmicro-behaviorsmetadatametadata/archobjectives/anti-staticobjectives/discoveryobjectives/credential-accessobjectives/anti-analysisobjectives+27 32d
Blitz.Blitz windows 32 days ago

Game cheat with process injection

sandbox-detect/tool-referencesenv/dotenv
micro-behaviors/cryptomicro-behaviorsmetadatametadata/langmicro-behaviors/osmicro-behaviors/processmicro-behaviors/datamicro-behaviors/fs 32d
ankitshuxe.Neko windows 32 days ago

Ransomware encryption indicators present

well-knownwell-known/toolmetadata/binarymetadataobjectives/anti-staticobjectives/discoveryobjectivesobjectives/collectionmicro-behaviors/processmicro-behaviorsobjectives/evasion+12 32d
GiMeSpace.RAMTempFolderPro windows 32 days ago

Process injection and privilege escalation

screenshot/captureinjection/dll

SATURDAY

Sat Aug 22 · 2 catches · 0 waves · 2 singles
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlobjectives/executionthird_partymicro-behaviors/dataobjectives/anti-staticobjectivesobjectives/collection+8 33d
82454D9F0D4B22BC8357285E8397EE3A.exe windows ✓ 33 days ago

.NET RAT with screen capture

screenshot/captureobfuscation/anti-decompile
objectivesobjectives/anti-analysiswell-known/appwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticobjectives/command-and-controlobjectives/impact+28 33d
Lody.Lody windows 33 days ago

Extensive spyware and injection APIs

FRIDAY

Fri Aug 21 · 2 catches · 0 waves · 2 singles
objectives/anti-staticwell-knownwell-known/librarymicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-analysismicro-behaviors/osobjectivesobjectives/evasion+8 34d
Oksion.XiControl windows 34 days ago

AMSI patch, APC loader, unsigned

anti-av/amsiplatform/defender
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/collectionobjectives/discoveryobjectives/persistenceobjectives/command-and-controlobjectives+15 34d
AntiMicroX.antimicrox windows 34 days ago

Unsigned dropper, C2, anti-analysis

loader/stage

THURSDAY

Thu Aug 20 · 1 catch · 0 waves · 1 single
objectivesobjectives/command-and-controlwell-knownwell-known/appmetadata/binarymetadataobjectives/discoverywell-known/libmicro-behaviors/fsmicro-behaviorsthird_party+11 35d
ironclaw windows 35 days ago

Credential theft and C2 indicators

EXE/Telegramchatbotsensitive/credentials

TUESDAY

Tue Aug 18 · 2 catches · 0 waves · 2 singles
well-knownwell-known/toolmicro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/exfiltrationmetadata/binarymetadataobjectives/evasionobjectives+15 37d
SMART.SMARTEducationSoftware windows 37 days ago

Unsigned Microsoft-claim embedded PE

masquerade/trustanomaly/rewrite
objectives/anti-staticwell-knownwell-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-analysisobjectives/command-and-controlobjectivesobjectives/evasion+12 37d
HaiYing.OfficeCLI windows 37 days ago

AMSI bypass, self-reading overlay loader

platform/defenderanti-av/amsi

MONDAY

Mon Aug 17 · 2 catches · 0 waves · 2 singles
objectives/anti-staticobjectiveswell-knownwell-known/toolsmicro-behaviors/cryptomicro-behaviorsmetadata/binarymetadataobjectives/discoverymicro-behaviors/osmicro-behaviors/process+7 38d
Sefinek.GenshinStellaMod windows 38 days ago

Packed embedded PE, HWID, unsigned

extraction/unexpected-loader-revisionextraction/loader-checksum-mismatch
objectives/anti-staticobjectiveswell-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/discoveryobjectives/evasionthird_party+15 38d
DeskRipple.DeskRipple windows 38 days ago

AgentTesla infostealer payload embedded

Win/Agentteslav3
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories