Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 70. Detected as malicious: 3. Missed: 67. Coverage: 4.3%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (48.93% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1112 – delete registry value
• T1222 – set file attributes
• T1497.001 – reference anti-VM strings targeting Xen
• T1083 – get common file path
• T1012 – query or enumerate registry key
• T1115 – open clipboard
• T1082 – check OS version
• T1083 – get file size
• T1083 – enumerate files on Windows
• T1082 – query environment variable
• T1529 – shutdown system
• T1125 – capture webcam image
• T1083 – check if file exists
• T1134 – modify access privileges
• T1083 – get file system object information
• T1112 – delete registry key
• T1012 – query or enumerate registry value
• T1027 – encode data using XOR
• T1010 – find graphical window
• T1083 – enumerate files recursively
• T1129 – link function at runtime on Windows
• T1059 – accept command line arguments
• T1082 – get disk size
• T1547.009 – create shortcut via IShellLink
• T1003 – Accessed credential storage registry keys
• T1539 – Touches a file containing cookies, possibly for information gathering
• T1564 – A process created a hidden window
• T1202 – Uses Windows utilities for basic functionality
• T1202 – Uses suspicious command line tools or Windows utilities
• T1036 – A file was accessed within the Public folder.
• T1070.006 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1070.006 – Reads from the memory of another process
• T1070.006 – Anomalous binary characteristics
• T1070.006 – The PE file contains an overlay
• T1070.006 – Reads data out of its own binary image
• T1548 – A file was accessed within the Public folder.
• T1070 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1070 – Reads from the memory of another process
• T1070 – Anomalous binary characteristics
• T1070 – The PE file contains an overlay
• T1070 – Reads data out of its own binary image
• T1064 – Attempts to execute suspicious powershell command arguments
• T1064 – A scripting utility was executed
• T1497 – Checks for mouse movement
• T1027 – Appears to use command line obfuscation
• T1564.003 – A process created a hidden window
• T1082 – Checks available memory
• T1082 – Collects information to fingerprint the system
• T1057 – Enumerates running processes
• T1057 – Uses Windows utilities to enumerate running processes
• T1057 – Expresses interest in specific running processes
• T1012 – Collects information to fingerprint the system
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1071 – Reads from the memory of another process
• T1071 – Anomalous binary characteristics
• T1071 – The PE file contains an overlay
• T1071 – Reads data out of its own binary image
• T1106 – Guard pages use detected – possible anti-debugging.
• T1059 – Appears to use command line obfuscation
• T1059 – Attempts to execute suspicious powershell command arguments
• T1059 – A scripting utility was executed
• T1059.001 – Attempts to execute suspicious powershell command arguments
• T1486 – Exhibits possible ransomware or wiper file modification behavior: overwrites_existing_files
• T1485 – Anomalous file deletion behavior detected (10+)
• T1047 – Queries process information (via WMI, Win32_Process)
• T1036 – Creates files inside the user directory
• T1057 – Queries a list of all running processes
• T1057 – Uses tasklist.exe to query information about running processes
• T1083 – Reads ini files
• T1082 – Queries process information (via WMI, Win32_Process)

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.