Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 64. Missed: 9. Coverage: 87.7%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (76.93% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

MITRE ATT&CK Mapping

• T1010 – enumerate gui resources
• T1082 – enumerate disk volumes
• T1027 – encrypt data using RC4 KSA
• T1614 – get geographical location
• T1056.001 – log keystrokes via application hook
• T1082 – query environment variable
• T1134 – modify access privileges
• T1083 – enumerate files recursively
• T1129 – parse PE header
• T1033 – get session user name
• T1087 – get session user name
• T1027 – encrypt data using AES
• T1115 – open clipboard
• T1083 – enumerate files on Windows
• T1614.001 – get keyboard layout
• T1083 – check if file exists
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1082 – get system information on Windows
• T1027 – encode data using XOR
• T1555.003 – gather firefox profile information
• T1543.003 – stop service
• T1489 – stop service
• T1027 – encrypt data using RC4 PRGA
• T1562.001 – disable system features via registry on Windows
• T1012 – query or enumerate registry value
• T1082 – get disk information
• T1115 – read clipboard data
• T1112 – delete registry key
• T1543.003 – pause service
• T1007 – enumerate services
• T1012 – query or enumerate registry key
• T1027 – reference AES constants
• T1055.012 – use process replacement
• T1620 – use process replacement
• T1112 – delete registry value
• T1059.003 – create reverse shell
• T1007 – query service status
• T1543.003 – continue service
• T1083 – get common file path
• T1543.003 – start service
• T1543.003 – modify service
• T1569.002 – modify service
• T1059.003 – execute shell command and capture output
• T1129 – link function at runtime on Windows
• T1529 – shutdown system
• T1056.001 – log keystrokes
• T1113 – capture screenshot
• T1070.004 – self delete
• T1056.001 – log keystrokes via polling
• T1082 – check OS version
• T1129 – link many functions at runtime
• T1222 – set file attributes
• T1083 – get file size
• T1564.003 – hide graphical window
• T1123 – capture microphone audio
• T1548.002 – bypass UAC via ICMLuaUtil
• T1547.001 – persist via Run registry key
• T1518 – get installed programs
• T1539 – Touches a file containing cookies, possibly for information gathering
• T1082 – Checks available memory
• T1071 – Performs HTTP requests potentially not found in PCAP.
• T1071 – HTTP traffic contains suspicious features which may be indicative of malware related traffic
• T1071 – Looks up the external IP address
• T1071 – A process attempted to delay the analysis task.
• T1071 – Attempts to connect to a dead IP:Port
• T1071 – Binary file triggered YARA rule
• T1010 – Monitors user input
• T1012 – Query OS Information
• T1027.002 – Resolves API functions dynamically
• T1055 – Injects a file into another process
• T1056 – Combination of other detections shows multiple input capture behaviors
• T1056.001 – Monitors keyboard input
• T1056.004 – Monitors keyboard input
• T1071.004 – Performs DNS request
• T1082 – Query OS Information
• T1095 – Connects to remote host
• T1115 – Captures clipboard data
• T1119 – Combination of other detections shows multiple input capture behaviors
• T1497.003 – Delays execution
• T1571 – Tries to connect using an uncommon port
• T1095 – Unsuccessful connections attempts were detected (with 1 different IP:Port)
• T1129 – The process tried to load dynamically one or more functions.
• T1179 – The process behaves as a keylogger (keyboard capturing detected)
• T1056 – The process behaves as a keylogger (keyboard capturing detected)
• T1059 – Apparent Internal Usage of CMD.EXE
• T1202 – Apparent Internal Usage of CMD.EXE
• T1063 – It Tries to detect injection methods
• T1055 – May try to detect the Windows Explorer process (often used for injection)
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1056 – Sample has functionality to log and monitor keystrokes, analyze it with the keystroke simulation cookbook
• T1056 – Installs a global keyboard hook
• T1057 – May try to detect the Windows Explorer process (often used for injection)
• T1560 – Public key (encryption) found
• T1571 – Detected TCP or UDP traffic on non-standard ports
• T1219 – Detected Remcos RAT
• T1105 – Downloads files from webservers via HTTP
• T1105 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
• T1105 – Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.
• T1095 – Downloads files from webservers via HTTP
• T1095 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
• T1071 – Downloads files from webservers via HTTP
• T1071 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
• T1071 – C2 URLs / IPs found in malware configuration

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.