Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 59. Missed: 14. Coverage: 80.8%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (52.86% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

MITRE ATT&CK Mapping

• T1134 – modify access privileges
• T1083 – enumerate files on Windows
• T1113 – capture screenshot
• T1082 – get disk information
• T1059 – compiled with AutoIt
• T1012 – query or enumerate registry key
• T1134 – acquire debug privileges
• T1082 – get COMSPEC environment variable
• T1115 – list drag and drop files
• T1027 – encode data using XOR
• T1056.001 – log keystrokes
• T1083 – get file version info
• T1082 – get memory capacity
• T1134.001 – impersonate user
• T1056.001 – log keystrokes via polling
• T1012 – query or enumerate registry value
• T1033 – get token membership
• T1115 – open clipboard
• T1083 – check if file exists
• T1497.001 – reference anti-VM strings targeting Xen
• T1129 – link function at runtime on Windows
• T1010 – enumerate gui resources
• T1497.002 – check for unmoving mouse cursor
• T1010 – find graphical window
• T1112 – delete registry key
• T1222 – set file attributes
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1082 – get disk size
• T1083 – get file size
• T1529 – shutdown system
• T1614.001 – get keyboard layout
• T1564.003 – hide graphical window
• T1129 – parse PE header
• T1027 – encode data using Base64
• T1083 – get common file path
• T1112 – delete registry value
• T1082 – get hostname
• T1082 – get system information on Windows
• T1105 – download and write a file
• T1016 – get socket status
• T1033 – get session user name
• T1087 – get session user name
• T1082 – query environment variable
• T1083 – enumerate files recursively
• T1547.009 – create shortcut via IShellLink
• T1115 – read clipboard data
• T1005 – Searches for sensitive browser data
• T1005 – Reads sensitive browser data
• T1012 – Query OS Information
• T1012 – Possibly does reconnaissance
• T1027.002 – Creates a page with write and execute permissions
• T1055 – Writes into the memory of another process
• T1055 – Modifies control flow of another process
• T1057 – Enumerates running processes
• T1071.004 – Performs DNS request
• T1082 – Enumerates running processes
• T1082 – Query OS Information
• T1083 – Possibly does reconnaissance
• T1083 – Searches for sensitive browser data
• T1083 – Reads sensitive browser data
• T1095 – Connects to remote host
• T1106 – Tries to detect kernel debugger
• T1106 – Makes direct system call to possibly evade hooking based monitoring
• T1115 – Captures clipboard data
• T1119 – Searches for sensitive browser data
• T1119 – Reads sensitive browser data
• T1497.003 – Delays execution
• T1552.001 – Searches for sensitive browser data
• T1552.001 – Reads sensitive browser data
• T1555.003 – Reads sensitive browser data
• T1564.003 – Creates process with hidden window
• T1622 – Tries to detect debugger
• T1622 – Tries to detect kernel debugger

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.