Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 60. Missed: 13. Coverage: 82.2%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (48.00% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1115 – read clipboard data
• T1056.001 – log keystrokes via polling
• T1129 – link many functions at runtime
• T1010 – enumerate gui resources
• T1027 – encode data using XOR
• T1056.001 – log keystrokes
• T1113 – capture screenshot
• T1059 – accept command line arguments
• T1010 – find graphical window
• T1614 – get geographical location
• T1012 – query or enumerate registry value
• T1564.003 – hide graphical window
• T1082 – get disk size
• T1082 – get number of processors
• T1129 – link function at runtime on Windows
• T1614.001 – get keyboard layout
• T1083 – get file version info
• T1055 – Contains .tls (Thread Local Storage) section
• T1027 – The binary contains an unknown PE section name indicative of packing
• T1027 – The binary likely contains encrypted or compressed data
• T1027.002 – The binary contains an unknown PE section name indicative of packing
• T1027.002 – The binary likely contains encrypted or compressed data
• T1059 – Detected command line output monitoring
• T1140 – Detected an attempt to pull out some data from the binary image
• T1129 – The process tried to load dynamically one or more functions.
• T1045 – Manalize Local SandBox Packer Harvesting
• T1027 – encode data using XOR
• T1564.003 – hide graphical window
• T1012 – query or enumerate registry value
• T1129 – link function at runtime on Windows
• T1614 – get geographical location
• T1010 – find graphical window
• T1082 – get disk size
• T1083 – get file version info
• T1115 – read clipboard data
• T1113 – capture screenshot
• T1129 – link many functions at runtime
• T1056.001 – log keystrokes
• T1056.001 – log keystrokes via polling
• T1614.001 – get keyboard layout
• T1082 – get number of processors
• T1010 – enumerate gui resources
• T1059 – accept command line arguments
• T1057 – The process attempted to detect a running debugger using common APIs
• T1082 – Queries for the computername
• T1082 – The binary presents some anomalies in its PE header and/or PE sections.
• T1010 – The binary presents some anomalies in its PE header and/or PE sections.
• T1056.001 – The binary presents some anomalies in its PE header and/or PE sections.
• T1083 – The binary presents some anomalies in its PE header and/or PE sections.
• T1059 – The binary presents some anomalies in its PE header and/or PE sections.
• T1129 – The binary presents some anomalies in its PE header and/or PE sections.
• T1012 – The binary presents some anomalies in its PE header and/or PE sections.
• T1115 – The binary presents some anomalies in its PE header and/or PE sections.
• T1113 – The binary presents some anomalies in its PE header and/or PE sections.
• T1614 – The binary presents some anomalies in its PE header and/or PE sections.
• T1027 – The binary presents some anomalies in its PE header and/or PE sections.
• T1564.003 – The binary presents some anomalies in its PE header and/or PE sections.
• T1614.001 – The binary presents some anomalies in its PE header and/or PE sections.
• T1053 – It registers tasks through ITaskFolder::RegisterTaskDefinition
• T1063 – It Tries to detect injection methods
• T1053 – Uses schtasks.exe or at.exe to add and modify task schedules
• T1055 – Queues an APC in another process (thread injection)
• T1055 – Early bird code injection technique detected
• T1055 – Allocates memory in foreign processes
• T1036 – Creates files inside the user directory
• T1497 – Checks if the current process is being debugged
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1218.011 – Runs a DLL by calling functions
• T1518.001 – Checks if the current process is being debugged
• T1518.001 – Allocates many large memory junks
• T1018 – Uses ping.exe to check the status of other devices and networks
• T1016 – Uses ping.exe to check the status of other devices and networks
• T1083 – Reads ini files
• T1082 – Queries the cryptographic machine GUID
• T1082 – Checks if Microsoft Office is installed
• T1082 – Checks the free space of harddrives
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1571 – Detected TCP or UDP traffic on non-standard ports
• T1071 – C2 URLs / IPs found in malware configuration

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.