Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For unknown, the dwell time for this case could not be accurately determined from available data.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 67. Detected as malicious: 46. Missed: 21. Coverage: 68.7%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

MITRE ATT&CK Mapping

• T1129 – Drops a binary and executes it
• T1082 – Checks available memory
• T1057 – Expresses interest in specific running processes
• T1057 – Enumerates running processes
• T1071 – Terminates another process
• T1071 – A named pipe was used for inter-process communication
• T1562 – Tries to unhook or modify Windows functions monitored by CAPE
• T1055 – Creates a process in a suspended state, likely for injection
• T1055 – Writes to the memory another process
• T1070 – Deletes executed files from disk
• T1562.001 – Tries to unhook or modify Windows functions monitored by CAPE
• T1485 – Anomalous file deletion behavior detected (10+)
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1082 – Queries the cryptographic machine GUID
• T1082 – Queries the volume information (name, serial number etc) of a device