Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 1+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 72. Detected as malicious: 59. Missed: 13. Coverage: 81.9%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (47.21% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1027 – encode data using XOR
• T1027 – encrypt data using Curve25519
• T1490 – delete Windows backup catalog
• T1134 – acquire debug privileges
• T1222 – set file attributes
• T1564.003 – hide graphical window
• T1059 – accept command line arguments
• T1053.005 – schedule task via schtasks
• T1490 – delete volume shadow copies
• T1070.004 – delete volume shadow copies
• T1070.001 – clear Windows event logs
• T1070.004 – self delete
• T1082 – get system information on Windows
• T1213 – reference WMI statements
• T1047 – connect to WMI namespace via WbemLocator
• T1083 – get common file path
• T1134 – modify access privileges
• T1129 – link function at runtime on Windows
• T1129 – link many functions at runtime
• T1082 – get disk information
• T1082 – enumerate disk volumes
• T1083 – get file size
• T1083 – enumerate files on Windows
• T1564 – Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
• T1202 – Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
• T1112 – Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
• T1564.003 – Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
• T1071 – Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
• T1053 – Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
• T1059 – Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
• T1074 – Adversaries may stage collected data in a central location or directory prior to Exfiltration.
• T1027 – encode data using XOR
• T1027 – encrypt data using Curve25519
• T1490 – delete Windows backup catalog
• T1134 – acquire debug privileges
• T1222 – set file attributes
• T1564.003 – hide graphical window
• T1059 – accept command line arguments
• T1053.005 – schedule task via schtasks
• T1082 – get system information on Windows
• T1047 – connect to WMI namespace via WbemLocator
• T1213 – reference WMI statements
• T1083 – get common file path
• T1134 – modify access privileges
• T1129 – link function at runtime on Windows
• T1129 – link many functions at runtime
• T1082 – get disk information
• T1082 – enumerate disk volumes
• T1083 – get file size
• T1083 – enumerate files on Windows
• T1490 – delete volume shadow copies
• T1070.004 – delete volume shadow copies
• T1070.001 – clear Windows event logs
• T1070.004 – self delete
• T1213 – The file contains some common ransomware-related keywords.
• T1490 – The file contains some common ransomware-related keywords.
• T1059 – The file contains some common ransomware-related keywords.
• T1070.001 – The file contains some common ransomware-related keywords.
• T1083 – The file contains some common ransomware-related keywords.
• T1222 – The file contains some common ransomware-related keywords.
• T1129 – The file contains some common ransomware-related keywords.
• T1082 – The file contains some common ransomware-related keywords.
• T1047 – The file contains some common ransomware-related keywords.
• T1027 – The file contains some common ransomware-related keywords.
• T1564.003 – The file contains some common ransomware-related keywords.
• T1134 – The file contains some common ransomware-related keywords.
• T1053.005 – The file contains some common ransomware-related keywords.
• T1070.004 – The file contains some common ransomware-related keywords.
• T1063 – It Tries to detect injection methods
• T1091 – Checks for available system drives (often done to infect USB drives)
• T1059 – Very long cmdline option found, this is very uncommon (may be encrypted or packed)
• T1053 – Uses schtasks.exe or at.exe to add and modify task schedules
• T1574.002 – Tries to load missing DLLs
• T1055 – May try to detect the Windows Explorer process (often used for injection)
• T1036 – Creates files inside the program directory
• T1036 – Creates files inside the user directory
• T1036 – Creates a directory in C:\Program Files
• T1562.001 – Disables Windows Defender
• T1562.001 – Adds a directory exclusion to Windows Defender
• T1497 – Contains medium sleeps (>= 30s)
• T1497 – Contains long sleeps (>= 3 min)
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1497 – Contains capabilities to detect virtual machines
• T1070 – Clears the windows event log
• T1070.004 – May delete shadow drive data (may be related to ransomware)
• T1518.001 – May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
• T1518.001 – Contains capabilities to detect virtual machines
• T1057 – May try to detect the Windows Explorer process (often used for injection)
• T1057 – Queries a list of all running processes
• T1010 – Sample monitors Window changes (e.g. starting applications), analyze the sample with the simulation cookbook
• T1120 – Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook
• T1120 – Checks for available system drives (often done to infect USB drives)
• T1082 – Reads software policies
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1080 – Spreads via windows shares (copies executable files to share folders)
• T1486 – Writes a notice file (html or txt) to demand a ransom
• T1490 – Uses bcdedit to modify the Windows boot settings

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.