Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 54. Missed: 19. Coverage: 74.0%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (49.74% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1056.001 – log keystrokes via polling
• T1129 – link many functions at runtime
• T1012 – query or enumerate registry key
• T1012 – query or enumerate registry value
• T1115 – open clipboard
• T1083 – get file size
• T1083 – enumerate files on Windows
• T1083 – enumerate files recursively
• T1129 – link function at runtime on Windows
• T1112 – delete registry key
• T1529 – shutdown system
• T1222 – set file attributes
• T1083 – get common file path
• T1112 – delete registry value
• T1070.004 – self delete
• T1125 – capture webcam image
• T1010 – find graphical window
• T1027 – encode data using XOR
• T1083 – check if file exists
• T1082 – get disk size
• T1083 – get file system object information
• T1082 – query environment variable
• T1083 – get file version info
• T1059 – accept command line arguments
• T1547.009 – create shortcut via IShellLink
• T1202 – Uses Windows utilities for basic functionality
• T1202 – Uses suspicious command line tools or Windows utilities
• T1112 – Installs itself for autorun at Windows startup
• T1497 – Checks for mouse movement
• T1497 – Detects the presence of Windows Defender AV emulator via files
• T1547 – Installs itself for autorun at Windows startup
• T1547.001 – Installs itself for autorun at Windows startup
• T1082 – Checks available memory
• T1083 – Detects the presence of Windows Defender AV emulator via files
• T1057 – Enumerates running processes
• T1057 – Expresses interest in specific running processes
• T1057 – Detects the presence of Windows Defender AV emulator via files
• T1057 – Uses Windows utilities to enumerate running processes
• T1518 – Detects the presence of Windows Defender AV emulator via files
• T1071 – Resolves a suspicious Top Level Domain (TLD)
• T1071 – The PE file contains an overlay
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1573 – Establishes an encrypted HTTPS connection
• T1059 – Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• T1059 – Executed a very long command line or script command which may be indicative of chained commands or obfuscation
• T1485 – Anomalous file deletion behavior detected (10+)
• T1129 – The process attempted to dynamically load a malicious function
• T1140 – Detected an attempt to pull out some data from the binary image
• T1129 – The process tried to load dynamically one or more functions.
• T1045 – Manalize Local SandBox Packer Harvesting
• T1222 – set file attributes
• T1083 – get file system object information
• T1027 – encode data using XOR
• T1012 – query or enumerate registry key
• T1112 – delete registry key
• T1010 – find graphical window
• T1082 – query environment variable
• T1012 – query or enumerate registry value
• T1083 – enumerate files on Windows
• T1083 – get file version info
• T1547.009 – create shortcut via IShellLink
• T1112 – delete registry value
• T1083 – get file size
• T1529 – shutdown system
• T1083 – get common file path
• T1059 – accept command line arguments
• T1056.001 – log keystrokes via polling
• T1082 – get disk size
• T1125 – capture webcam image
• T1115 – open clipboard
• T1083 – check if file exists
• T1129 – link function at runtime on Windows
• T1129 – link many functions at runtime
• T1083 – enumerate files recursively
• T1082 – Queries for the computername
• T1027.009 – Drops interesting files and uses them
• T1063 – It Tries to detect injection methods
• T1047 – Queries process information (via WMI, Win32_Process)
• T1059 – Very long cmdline option found, this is very uncommon (may be encrypted or packed)
• T1547.001 – Creates a start menu entry (Start Menu\\Programs\\Startup)
• T1547.001 – Stores files to the Windows startup directory
• T1055 – May try to detect the Windows Explorer process (often used for injection)
• T1036 – Drops PE files with a suspicious file extension
• T1036 – Drops files with a non matching file extension (content does not match to file extension)
• T1036 – Creates files inside the user directory
• T1036 – Creates files inside the system directory
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1057 – Queries a list of all running processes
• T1057 – Uses tasklist.exe to query information about running processes
• T1057 – May try to detect the Windows Explorer process (often used for injection)
• T1083 – Reads ini files
• T1083 – Enumerates the file system
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Queries process information (via WMI, Win32_Process)

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.