Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 61. Missed: 12. Coverage: 83.6%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Heavy cryptographic operations (99.75% of behavior) indicate potential ransomware, data encryption for exfiltration, or secure C2 communications. The malware is actively encrypting or decrypting sensitive data.

MITRE ATT&CK Mapping

• T1012 – query or enumerate registry value
• T1082 – query environment variable
• T1083 – enumerate files in .NET
• T1083 – get file size
• T1082 – get hostname
• T1134 – modify access privileges
• T1057 – enumerate process modules
• T1055.001 – inject dll
• T1082 – get MAC address in .NET
• T1620 – invoke .NET assembly method
• T1027 – reference Base64 string
• T1083 – check if file exists
• T1027 – encrypt data using DPAPI
• T1047 – access WMI data in .NET
• T1622 – hide thread from debugger
• T1113 – capture screenshot
• T1082 – get disk information
• T1497 – check for sandbox username or hostname
• T1033 – get session integrity level
• T1129 – link function at runtime on Windows
• T1112 – delete registry value
• T1010 – find graphical window
• T1057 – find process by name
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1056.001 – log keystrokes
• T1497.001 – reference anti-VM strings targeting Qemu
• T1620 – load .NET assembly
• T1053.005 – schedule task via schtasks
• T1213 – reference SQL statements
• T1497.001 – reference anti-VM strings targeting VMWare
• T1562.001 – disable system features via registry on Windows
• T1140 – decode data using Base64 in .NET
• T1083 – check if directory exists
• T1562 – set TCP connection state
• T1497.001 – reference anti-VM strings targeting Xen
• T1016 – get networking interfaces
• T1082 – get system information on Windows
• T1012 – query or enumerate registry key
• T1115 – check clipboard data
• T1027 – encrypt or decrypt data via BCrypt
• T1213 – reference WMI statements
• T1033 – get session user name
• T1087 – get session user name
• T1057 – find process by PID
• T1115 – monitor clipboard content
• T1057 – enumerate threads
• T1115 – read clipboard data
• T1564 – hide the Windows taskbar
• T1016 – get domain information
• T1564.003 – hide graphical window
• T1112 – delete registry key
• T1614 – get geographical location
• T1134 – acquire debug privileges
• T1082 – get OS version in .NET
• T1083 – get common file path
• T1497.001 – reference anti-VM strings targeting VirtualBox
• T1010 – enumerate gui resources
• T1497.001 – reference anti-VM strings
• T1546.001 – persist via default file association registry key
• T1222 – set file attributes
• T1055.003 – inject thread
• T1620 – inject thread
• T1140 – extract zip archive in .NET
• T1070.004 – self delete
• T1497.001 – reference anti-VM strings targeting Parallels
• T1082 – Checks available memory
• T1071 – Binary file triggered multiple YARA rules
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1071 – Attempts to connect to a dead IP:Port
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – Resolves a suspicious Top Level Domain (TLD)
• T1071 – Reads from the memory of another process
• T1106 – Guard pages use detected – possible anti-debugging.
• T1070.006 – Binary compilation timestomping detected
• T1070 – Binary compilation timestomping detected
• T1027 – The binary likely contains encrypted or compressed data
• T1027.002 – The binary likely contains encrypted or compressed data
• T1129 – The process attempted to dynamically load a malicious function
• T1129 – The process tried to load dynamically one or more functions.
• T1057 – The process has tried to detect the debugger probing the use of page guards.
• T1564.003 – hide graphical window
• T1115 – monitor clipboard content
• T1222 – set file attributes
• T1140 – extract zip archive in .NET
• T1134 – acquire debug privileges
• T1082 – get OS version in .NET
• T1083 – get file size
• T1082 – get system information on Windows
• T1056.001 – log keystrokes
• T1010 – enumerate gui resources
• T1113 – capture screenshot
• T1115 – check clipboard data
• T1115 – read clipboard data
• T1033 – get session integrity level
• T1083 – check if directory exists
• T1057 – find process by name
• T1083 – check if file exists
• T1053.005 – schedule task via schtasks
• T1083 – enumerate files on Windows
• T1012 – query or enumerate registry key
• T1012 – query or enumerate registry value
• T1027 – encrypt or decrypt data via BCrypt
• T1083 – get common file path
• T1140 – decode data using Base64 in .NET
• T1027 – encrypt data using DPAPI
• T1129 – link function at runtime on Windows
• T1082 – get disk information
• T1082 – query environment variable
• T1016 – get domain information
• T1614 – get geographical location
• T1057 – find process by PID
• T1620 – load .NET assembly
• T1047 – access WMI data in .NET
• T1213 – reference WMI statements
• T1016 – get networking interfaces
• T1082 – get MAC address on Windows
• T1112 – delete registry value
• T1134 – modify access privileges
• T1213 – reference SQL statements
• T1082 – get hostname
• T1112 – delete registry key
• T1055 – write process memory
• T1057 – enumerate process modules
• T1055.001 – inject dll
• T1057 – enumerate threads
• T1010 – find graphical window
• T1564 – hide the Windows taskbar
• T1027 – reference Base64 string
• T1057 – The process attempted to detect a running debugger using common APIs
• T1071 – The process behaves as a known keylogger (iSpy)
• T1033 – get session user name
• T1087 – get session user name
• T1070.004 – self delete
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1055.003 – inject thread
• T1620 – inject thread
• T1497 – check for sandbox username or hostname
• T1622 – hide thread from debugger
• T1497.001 – reference anti-VM strings targeting Qemu
• T1497.001 – reference anti-VM strings targeting Xen
• T1497.001 – reference anti-VM strings
• T1497.001 – reference anti-VM strings targeting VirtualBox
• T1497.001 – reference anti-VM strings targeting Parallels
• T1497.001 – reference anti-VM strings targeting VMWare
• T1055 – May try to detect the Windows Explorer process (often used for injection)
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1562.001 – Contains functionality to disable the Task Manager (.Net Source)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1564.001 – Hides that the sample has been downloaded from the Internet (zone.identifier)
• T1027 – .NET source code contains long base64-encoded strings
• T1027 – Binary may include packed or crypted data
• T1027.002 – .NET source code contains potential unpacker
• T1027.002 – PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)
• T1027.002 – Binary may include packed or crypted data
• T1070.006 – Binary contains a suspicious time stamp
• T1057 – May try to detect the Windows Explorer process (often used for injection)
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Queries the cryptographic machine GUID
• T1571 – Detected TCP or UDP traffic on non-standard ports

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.