Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 1+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 41. Missed: 32. Coverage: 56.2%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

MITRE ATT&CK Mapping

• T1016 – get local IPv4 addresses
• T1082 – check OS version
• T1027 – encrypt data using RC4 PRGA
• T1213 – reference WMI statements
• T1027 – encrypt data using speck
• T1027 – encode data using Base64
• T1083 – check if file exists
• T1087 – get logon sessions
• T1027 – encrypt data using Salsa20 or ChaCha
• T1027.005 – resolve function by djb2 hash
• T1129 – link many functions at runtime
• T1082 – get disk information
• T1057 – enumerate threads
• T1057 – enumerate processes via NtQuerySystemInformation
• T1518 – enumerate processes via NtQuerySystemInformation
• T1027 – encode data using XOR
• T1082 – get system information on Windows
• T1082 – query environment variable
• T1129 – parse PE header
• T1082 – get disk size
• T1082 – get memory capacity
• T1087 – list user accounts
• T1083 – get common file path
• T1129 – link function at runtime on Windows
• T1057 – enumerate process modules
• T1059 – accept command line arguments
• T1027 – reference Base64 string
• T1087 – list groups for user account
• T1202 – Uses suspicious command line tools or Windows utilities
• T1202 – Uses Windows utilities for basic functionality
• T1562 – Attempts to disable Windows Defender
• T1562 – Attempts to modify Windows Defender using PowerShell
• T1036 – A file was accessed within the Public folder.
• T1055 – Contains .tls (Thread Local Storage) section
• T1548 – A file was accessed within the Public folder.
• T1070 – Clears Windows events or logs
• T1064 – A scripting utility was executed
• T1064 – Attempts to execute suspicious powershell command arguments
• T1562.001 – Attempts to disable Windows Defender
• T1562.001 – Attempts to modify Windows Defender using PowerShell
• T1082 – Checks available memory
• T1082 – Collects information to fingerprint the system
• T1057 – Enumerates running processes
• T1012 – Collects information to fingerprint the system
• T1071 – At least one IP Address, Domain, or File Name was found in a crypto call
• T1071 – Reads from the memory of another process
• T1071 – Dynamic (imported) function loading detected
• T1106 – Guard pages use detected – possible anti-debugging.
• T1059 – Attempts to disable Windows Defender
• T1059 – A scripting utility was executed
• T1059 – Attempts to modify Windows Defender using PowerShell
• T1059 – Attempts to execute suspicious powershell command arguments
• T1059.001 – Attempts to execute suspicious powershell command arguments
• T1486 – Exhibits possible ransomware or wiper file modification behavior: mass_file_deletion overwrites_existing_files
• T1485 – Anomalous file deletion behavior detected (10+)
• T1485 – Clears Windows events or logs
• T1059 – Uses cmd line tools excessively to alter registry or file data
• T1548 – Found direct / indirect Syscall (likely to bypass EDR)
• T1548.002 – Disable Windows Defender real time protection (registry)
• T1036 – Creates files inside the user directory
• T1112 – Uses reg.exe to modify the Windows registry
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1562.001 – Disable Windows Defender real time protection (registry)
• T1562.001 – Disables Windows Defender
• T1562.001 – Modifies Windows Defender protection settings
• T1497 – Checks if the current process is being debugged
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1497 – Hides threads from debuggers
• T1518.001 – Checks if the current process is being debugged
• T1518.001 – Hides threads from debuggers
• T1057 – Queries a list of all running processes
• T1082 – Queries the volume information (name, serial number etc) of a device

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.