A campaign they targeting Brazilian banking customers. The threat-actors were using script interpreters (think wscript.exe and powershell.exe) to execute scripts that pulled the previously-stored malware from multiple directory locations to inject into DLLs. By executing from digitally signed code, such as the DLLs targeted, the requests the malware makes are less suspicious. Some anti-virus software may even ignore the code’s activity since it was a digitally signed and therefore seen as a trusted application. DLLs from Avira, AVG, Avast, Damon Tools, Steam, and NVIDIA were the more frequent vendors used in this campaign. The infection begins with an MSI installer that contains both legitimate and malicious files. After installing, the legitimate binary is run, which loads the malicious DLL.