Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For unknown, the dwell time for this case could not be accurately determined from available data.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 56. Detected as malicious: 24. Missed: 32. Coverage: 42.9%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

MITRE ATT&CK Mapping

• T1071 – Attempts to connect to a dead IP:Port
• T1071 – Reads data out of its own binary image
• T1071 – HTTP traffic contains suspicious features which may be indicative of malware related traffic
• T1106 – Created a process from a suspicious location
• T1485 – Anomalous file deletion behavior detected (10+)
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1082 – Queries the cryptographic machine GUID
• T1082 – Queries the volume information (name, serial number etc) of a device