Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 26+ days, this malware remained undetected — exceeding industry median dwell time and granting the adversary substantial opportunity for persistent operations, extensive reconnaissance, privilege escalation, and potential large-scale data exfiltration.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 48. Missed: 25. Coverage: 65.8%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

MITRE ATT&CK Mapping

• T1027.002 – packed with enigma
• T1497.001 – reference anti-VM strings targeting VMWare
• T1497.001 – reference anti-VM strings
• T1497.001 – reference anti-VM strings targeting Parallels
• T1497.001 – reference anti-VM strings targeting Qemu
• T1497.001 – reference anti-VM strings targeting VirtualBox
• T1562 – Tries to unhook or modify Windows functions monitored by CAPE
• T1036 – A file was accessed within the Public folder.
• T1070.006 – Binary compilation timestomping detected
• T1548 – A file was accessed within the Public folder.
• T1070 – Binary compilation timestomping detected
• T1562.001 – Tries to unhook or modify Windows functions monitored by CAPE
• T1027 – The binary contains an unknown PE section name indicative of packing
• T1027 – Executable file is packed/obfuscated with Enigma
• T1027 – The binary likely contains encrypted or compressed data
• T1027.002 – The binary contains an unknown PE section name indicative of packing
• T1027.002 – Executable file is packed/obfuscated with Enigma
• T1027.002 – The binary likely contains encrypted or compressed data
• T1539 – Touches a file containing cookies, possibly for information gathering
• T1082 – Checks available memory
• T1071 – Reads data out of its own binary image
• T1071 – The PE file contains an overlay
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – Binary file triggered YARA rule
• T1071 – Terminates another process
• T1198 – The binary has an Authenticode signature
• T1198 – The file have a Trusted Certificate
• T1045 – Manalize Local SandBox Packer Harvesting
• T1071 – Detected HTTP requests to some non white-listed domains
• T1063 – It Tries to detect injection methods
• T1548 – Found direct / indirect Syscall (likely to bypass EDR)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1027 – Binary may include packed or crypted data
• T1027.002 – Binary may include packed or crypted data
• T1027.002 – PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)
• T1070.006 – Binary contains a suspicious time stamp
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Queries the cryptographic machine GUID
• T1573 – Uses HTTPS
• T1071 – Uses HTTPS

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.