Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 57. Missed: 16. Coverage: 78.1%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Heavy cryptographic operations (99.75% of behavior) indicate potential ransomware, data encryption for exfiltration, or secure C2 communications. The malware is actively encrypting or decrypting sensitive data.

MITRE ATT&CK Mapping

• T1070.004 – self delete
• T1620 – invoke .NET assembly method
• T1082 – get hostname
• T1083 – get file size
• T1082 – get OS version in .NET
• T1083 – enumerate files in .NET
• T1012 – query or enumerate registry value
• T1083 – check if file exists
• T1012 – query or enumerate registry key
• T1620 – load .NET assembly
• T1497.001 – reference anti-VM strings
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1112 – delete registry value
• T1033 – get session user name
• T1087 – get session user name
• T1083 – check if directory exists
• T1082 – query environment variable
• T1082 – get system information on Windows
• T1140 – decode data using Base64 in .NET
• T1082 – get disk size
• T1033 – get session integrity level
• T1497.001 – reference anti-VM strings targeting VirtualBox
• T1213 – reference SQL statements
• T1497.001 – reference anti-VM strings targeting Qemu
• T1560.002 – compress data using GZip in .NET
• T1027 – encode data using Base64
• T1497.001 – reference anti-VM strings targeting VMWare
• T1083 – get common file path
• T1082 – get number of processors
• T1047 – access WMI data in .NET
• T1053.005 – schedule task via schtasks
• T1027 – reference Base64 string
• T1112 – delete registry key
• T1539 – Touches a file containing cookies, possibly for information gathering
• T1564 – A process created a hidden window
• T1202 – Uses Windows utilities for basic functionality
• T1202 – Uses suspicious command line tools or Windows utilities
• T1112 – Installs itself for autorun at Windows startup
• T1064 – Attempts to execute suspicious powershell command arguments
• T1064 – A scripting utility was executed
• T1564.003 – A process created a hidden window
• T1082 – Checks available memory
• T1071 – Attempts to connect to a dead IP:Port
• T1071 – Reads data out of its own binary image
• T1071 – DNS query to a paste site or service detected
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – Binary file triggered YARA rule
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1573 – Establishes an encrypted HTTPS connection
• T1573 – Establishes an encrypted HTTPS connection to a paste site
• T1053 – Installs itself for autorun at Windows startup
• T1106 – Guard pages use detected – possible anti-debugging.
• T1059 – Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• T1059 – Attempts to execute suspicious powershell command arguments
• T1059 – A scripting utility was executed
• T1059.001 – Attempts to execute suspicious powershell command arguments
• T1057 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1059 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1027 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1129 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1222 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1620 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1614 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1083 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1012 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1010 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1564.003 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1497.001 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1082 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
• T1129 – The process attempted to dynamically load a malicious function
• T1129 – The process tried to load dynamically one or more functions.
• T1057 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1059 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1027 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1129 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1222 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1620 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1614 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1083 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1012 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1010 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1564.003 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1497.001 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1082 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
• T1057 – The process has tried to detect the debugger probing the use of page guards.
• T1057 – The process attempted to detect a running debugger using common APIs
• T1071 – The process behaves as a known keylogger (iSpy)
• T1057 – Manalize Local SandBox Strings
• T1059 – Manalize Local SandBox Strings
• T1027 – Manalize Local SandBox Strings
• T1129 – Manalize Local SandBox Strings
• T1222 – Manalize Local SandBox Strings
• T1620 – Manalize Local SandBox Strings
• T1614 – Manalize Local SandBox Strings
• T1083 – Manalize Local SandBox Strings
• T1012 – Manalize Local SandBox Strings
• T1010 – Manalize Local SandBox Strings
• T1564.003 – Manalize Local SandBox Strings
• T1497.001 – Manalize Local SandBox Strings
• T1082 – Manalize Local SandBox Strings

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.