Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 11+ hours, this malware remained undetected — a several-hour window that allowed the adversary to complete initial compromise and begin early-stage persistence establishment.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 29. Missed: 44. Coverage: 39.7%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (35.70% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

MITRE ATT&CK Mapping

• T1059 – accept command line arguments
• T1115 – open clipboard
• T1056.001 – log keystrokes via polling
• T1083 – get common file path
• T1027 – encode data using XOR
• T1083 – get file size
• T1070.006 – timestomp file
• T1113 – capture screenshot
• T1027 – encrypt data using RC4 PRGA
• T1083 – check if file exists
• T1222 – set file attributes
• T1115 – read clipboard data
• T1129 – link function at runtime on Windows
• T1027 – encrypt data using RC4 KSA
• T1129 – Adversaries may execute malicious payloads via loading shared modules.
• T1014 – Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
• T1542.003 – Adversaries may use bootkits to persist on systems.
• T1564 – Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
• T1055 – Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.
• T1542 – Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.
• T1564.001 – Adversaries may set files and directories to be hidden to evade detection mechanisms.
• T1564.004 – Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection.
• T1082 – An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
• T1071 – Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
• T1496 – Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems, which may impact system and/or hosted service availability.
• T1574.002 – Tries to load missing DLLs
• T1036 – Creates files inside the user directory
• T1036 – Drops files with a non matching file extension (content does not match to file extension)
• T1056 – Creates a DirectInput object (often for capturing keystrokes)
• T1518.001 – May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
• T1083 – Reads ini files
• T1083 – Writes ini files
• T1082 – Reads software policies
• T1018 – Reads the hosts file
• T1095 – Performs DNS lookups
• T1095 – Downloads files from webservers via HTTP
• T1071 – Performs DNS lookups
• T1071 – Downloads files from webservers via HTTP
• T1071 – Downloads executable code via HTTP
• T1105 – Downloads files from webservers via HTTP
• T1105 – Downloads executable code via HTTP

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.