Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For unknown, the dwell time for this case could not be accurately determined from available data.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 56. Detected as malicious: 32. Missed: 24. Coverage: 57.1%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

MITRE ATT&CK Mapping

• T1129 – Drops a binary and executes it
• T1106 – Guard pages use detected – possible anti-debugging.
• T1059 – A script or command line contains a long continuous string indicative of obfuscation
• T1059 – A scripting utility was executed
• T1064 – A scripting utility was executed
• T1562 – Tries to unhook or modify Windows functions monitored by CAPE
• T1036 – A file was accessed within the Public folder.
• T1055 – Creates a process in a suspended state, likely for injection
• T1055 – Writes to the memory another process
• T1548 – A file was accessed within the Public folder.
• T1562.001 – Tries to unhook or modify Windows functions monitored by CAPE
• T1082 – Checks available memory
• T1057 – Enumerates running processes
• T1071 – Reads from the memory of another process
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1071 – JavaScript timer detected to delay or measure execution time
• T1071 – Terminates another process
• T1071 – Reads data out of its own binary image
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1083 – Enumerates the file system
• T1082 – Queries the cryptographic machine GUID
• T1082 – Queries the volume information (name, serial number etc) of a device