Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 53. Missed: 20. Coverage: 72.6%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

MITRE ATT&CK Mapping

• T1082 – get system information on Windows
• T1620 – invoke .NET assembly method
• T1213 – reference WMI statements
• T1497.001 – reference anti-VM strings targeting VirtualBox
• T1083 – get file size
• T1087 – list user accounts
• T1059.001 – run PowerShell expression
• T1082 – query environment variable
• T1012 – query or enumerate registry key
• T1083 – check if directory exists
• T1115 – check clipboard data
• T1082 – get MAC address in .NET
• T1115 – read clipboard data
• T1134.001 – impersonate user
• T1082 – get hostname
• T1140 – decode data using Base64 in .NET
• T1016 – get domain information
• T1129 – link function at runtime on Windows
• T1082 – get disk information
• T1057 – find process by PID
• T1082 – get disk size
• T1083 – get file system object information
• T1083 – get file version info
• T1083 – enumerate files in .NET
• T1547.001 – reference startup folder
• T1620 – load .NET assembly
• T1016 – get networking interfaces
• T1027 – encode data using Base64
• T1497.001 – reference anti-VM strings
• T1497.001 – reference anti-VM strings targeting Xen
• T1555.003 – gather firefox profile information
• T1082 – get OS version in .NET
• T1083 – enumerate files on Windows
• T1016.001 – list domain servers
• T1555.004 – acquire credentials from Windows Credential Manager
• T1497.001 – reference anti-VM strings targeting VMWare
• T1083 – check if file exists
• T1555.003 – gather chrome based browser login information
• T1134 – modify access privileges
• T1033 – get session information
• T1213 – reference SQL statements
• T1222 – set file attributes
• T1033 – get session integrity level
• T1652 – enumerate device drivers on Windows
• T1083 – get common file path
• T1087 – get logon sessions
• T1033 – get session user name
• T1087 – get session user name
• T1012 – query or enumerate registry value
• T1057 – find process by name
• T1047 – access WMI data in .NET
• T1082 – get number of processors
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1027 – encrypt data using DPAPI
• T1134 – acquire debug privileges
• T1003 – Accessed credential storage registry keys
• T1082 – Checks available memory
• T1071 – The PE file contains a PDB path
• T1106 – Guard pages use detected – possible anti-debugging.
• T1202 – Uses Windows utilities for basic functionality
• T1036 – A file was accessed within the Public folder.
• T1070.006 – Binary compilation timestomping detected
• T1548 – A file was accessed within the Public folder.
• T1070 – Binary compilation timestomping detected
• T1027 – The binary likely contains encrypted or compressed data
• T1027.002 – The binary likely contains encrypted or compressed data
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1070.006 – Binary contains a suspicious time stamp
• T1033 – Reads the Windows registered organization settings
• T1033 – Reads the Windows registered owner settings
• T1083 – Enumerates the file system
• T1082 – Queries information about the installed CPU (vendor, model number etc)
• T1082 – Queries the volume information (name, serial number etc) of a device

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.