MALFEX npm Supply-Chain Campaign: Overlord RAT, movinlike Stealer and function-flag Downloader

Looks for: AutoIt3.exe started with an .a3x argument, the exact form of the Overlord persistence command (AutoIt3.exe h.a3x) and the loader run. FP: admins who legitimately run compiled AutoIt scripts. AutoIt3.exe is a signed legitimate tool, so this is detect-only.

// HUNT: AutoIt3.exe running an .a3x script (MALFEX Overlord loader)
// MITRE: T1059, T1053.005, T1055.012
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 on Windows
// FALSE POSITIVES: IT automation that runs .a3x scripts
// TUNING: scope to unmanaged paths by keeping ImageFileName matching ScopeSmart, or allowlist your own AutoIt deployment folder; any AutoIt3.exe under a user profile on a developer host deserves review
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^AutoIt3(_x64)?\.exe$/i
| CommandLine=/\.a3x/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

Looks for: schtasks.exe creating or changing a task whose name contains Maiden, or whose action references an .a3x script or the ScopeSmart folder.

// HUNT: schtasks creating the Maiden persistence task (MALFEX Overlord)
// MITRE: T1053.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on Windows
// FALSE POSITIVES: an unrelated internal task that is also named Maiden (verify the action)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^schtasks\.exe$/i
| CommandLine=/Maiden|\.a3x|ScopeSmart/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

Looks for: TapiUnattend.exe, a stock Windows binary that is rarely run on endpoints. Overlord is injected into it by process hollowing with a spoofed explorer.exe parent. Detect-only: the binary is legitimate, so the signal is its unusual execution, not its name or hash.

// HUNT: TapiUnattend.exe execution (possible Overlord hollowing target)
// MITRE: T1055.012, T1134.004
// CONF: medium
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on Windows
// FALSE POSITIVES: Windows telephony unattended setup; rare outside OS setup and repair
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^TapiUnattend\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

Looks for: Execution of gldriver_pre_core.exe or gldriver_pre_asset.exe, the names the Overlord loader PNG is saved as before launch.

// HUNT: gldriver_pre_core / gldriver_pre_asset executed (MALFEX Overlord loader)
// MITRE: T1204.005, T1036
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on Windows
// FALSE POSITIVES: none expected
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^gldriver_pre_(core|asset)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

Looks for: A process named node_runtime_helper, the Go downloader that img-to-native writes under %APPDATA%\Microsoft\Windows\ and that fetches setup.exe (movinlike).

// HUNT: node_runtime_helper.exe running (MALFEX movinlike chain)
// MITRE: T1105, T1204.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on Windows
// FALSE POSITIVES: none known; the name is specific to this chain in the source report
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^node_runtime_helper(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

Looks for: Outbound IPv4 connections to the four operator-controlled addresses named in the Checkmarx report (movinlike host and three function-flag payload hosts).

// HUNT: connections to MALFEX operator IPs
// MITRE: T1105, T1071.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: NetworkConnectIP4 on Windows
// FALSE POSITIVES: IP reassignment over time; check the first-seen date against the 2026-09 reporting window
#event_simpleName=NetworkConnectIP4
| in(field=RemoteAddressIP4, values=["104.234.65.75", "45.89.30.194", "191.96.81.101", "51.137.158.178"])
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4])

Looks for: node.exe, svchost.exe, nocry.exe or malfex.exe running directly from AppData\Roaming with no subfolder, the location function-flag writes its payload. node.exe and svchost.exe are legitimate names; the abnormal path is the signal. FP: portable Node.js installs unpacked into Roaming.

// HUNT: payload executables at the root of AppData Roaming (MALFEX function-flag)
// MITRE: T1105, T1036.005
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 on Windows
// FALSE POSITIVES: portable Node.js copy placed in Roaming by a developer
// TUNING: svchost.exe, nocry.exe and malfex.exe in this location are near-certain malicious; for node.exe exclude hosts where your standard dev image places Node there, and review the parent process
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^(node|svchost|nocry|malfex)\.exe$/i
| ImageFileName=/\\AppData\\Roaming\\(node|svchost|nocry|malfex)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

Looks for: DNS requests for the function-flag payload hosts, plus api.imghippo.com when the requesting process is node or npm. api.imghippo.com is a legitimate image host, so it is only matched in a node context.

// HUNT: DNS lookups for MALFEX payload hosts, imghippo from node only
// MITRE: T1105, T1102
// CONF: high
// FP: low
// COST: low
// REQUIRES: DnsRequest on Windows
// FALSE POSITIVES: developers who legitimately use imghippo through a node tool
#event_simpleName=DnsRequest
| DomainName=/^(cdnzona\.discloud\.app|apicdn\.squareweb\.app|apizona\.onrender\.com|bypasscdn\.onrender\.com|api\.imghippo\.com)$/i
| case {
    DomainName=/imghippo/i ContextBaseFileName=/^(node|npm|npx)(\.exe)?$/i | hit := "imghippo-from-node";
    DomainName!=/imghippo/i | hit := "payload-host";
    * | hit := "ignore" }
| hit!="ignore"
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, DomainName, hit])

Looks for: Process executions whose SHA-256 matches the loader, the decoded Overlord and all five published movinlike builds from Checkmarx. movinlike was rebuilt repeatedly in late September 2026, so all four dated samples are included alongside the main Node.js build. The signed AutoIt3.exe hash is deliberately left out of this query, because that binary is the legitimate interpreter; it is hunted by behavior in Q1.

// HUNT: MALFEX payload hashes executing
// MITRE: T1204.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 SHA256HashData on Windows
// FALSE POSITIVES: none expected
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| in(field=SHA256HashData, values=["9aba4685af072231aee049e1a5e294965580001b364d7d00152d84fcec1ce793", "2989244eac2a4bc7a13a09dec003e5c05ef7c80b2afe0958ce25042d5b804210", "c9c374afba4658dff15f71801e88c4d199c91dd2622d72c7b0c55577c8f73437", "889e13e227bc2b762178b88c35c691db3256e72be64d92ff1f381d29a2789849", "e7f86f6cc4380db66d333eaf6f7dfc2c12d232c2bcd526434681245dea25efa4", "ff826d2778ea1d40ce8ebfd9d66ecc86d4c811f5654b8a466a7e220ebbbc6807", "2f268ca76ab27971d8b16bd4ded26e1f9cd3d4460b894af2d4bdf89f0ab7ec4b"])
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, SHA256HashData])

Looks for: node.exe started with example.js by a package manager shell, the function-flag postinstall that triggers the Bloody ASCII-art call. FP: any package that ships a harmless example.js.

// HUNT: node running example.js from a package postinstall (MALFEX function-flag)
// MITRE: T1059.007, T1204.005
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 on Windows
// FALSE POSITIVES: legitimate packages that run their own example.js
// TUNING: require the CommandLine to include node_modules and function-flag or function-color, or join Q7 on the same aid within 10 minutes; exclude known internal package names
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^node(\.exe)?$/i
| CommandLine=/example\.js/i
| ParentBaseFileName=/^(cmd|powershell|pwsh|npm|node)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])