Zero‑Dwell Threat Intelligence Report
A narrative, executive‑ready view into the malware’s behavior, exposure, and reliable defenses.
Generated: 2026-06-26 06:23:21 UTC
Executive Overview — What We’re Dealing With
This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.
File
_drag_worm1.py
Type
Python script, Unicode text, UTF-8 text executable, with very long lines (8001u)
SHA‑1
1b4b4e910bfd31f5f3f2f3a269bf2c994978b78a
MD5
—
First Seen
—
Last Analysis
—
Dwell Time
unknown
Extended Dwell Time Impact
For unknown, the dwell time for this case could not be accurately determined from available data.
Comparative Context
Industry studies report a median dwell time closer to 21–24 days. The dwell time for this case could not be accurately determined.
Timeline
| Time (UTC) | Event | Elapsed |
|---|---|---|
| 2025-03-06 05:16:56 UTC | First VirusTotal submission | — |
| 2026-06-25 09:18:21 UTC | Latest analysis snapshot | 476 days, 4 hours, 1 minutes |
| 2026-06-26 06:23:21 UTC | Report generation time | 477 days, 1 hours, 6 minutes |
Why It Matters
Every additional day of dwell time is not just an abstract number — it is attacker opportunity. Each day equates to more time for lateral movement, stealth persistence, and intelligence gathering.
Global Detection Posture — Who Caught It, Who Missed It
VirusTotal engines: 61. Detected as malicious: 25. Missed: 36. Coverage: 41.0%.
Detected Vendors
- Xcitium
- +24 additional vendors (names not provided)
List includes Xcitium plus an additional 18 vendors per the provided summary.
Missed Vendors
- Acronis
- AhnLab-V3
- Avast
- AVG
- Avira
- Bkav
- CAT-QuickHeal
- ClamAV
- CMC
- CrowdStrike
- Cynet
- DrWeb
- F-Secure
- Fortinet
- google_safebrowsing
- Gridinsoft
- huorong
- Jiangmin
- K7AntiVirus
- K7GW
- Kingsoft
- Malwarebytes
- MaxSecure
- NANO-Antivirus
- Panda
- Sangfor
- SentinelOne
- SUPERAntiSpyware
- TACHYON
- VBA32
- VirIT
- ViRobot
- Xcitium
- Yandex
- Zillya
- Zoner
Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.
MITRE ATT&CK Mapping
- T1574.002 – Tries to load missing DLLs
- T1082 – Reads software policies
- T1082 – Queries the volume information (name, serial number etc) of a device
- T1560 – Public key (encryption) found
Persistence & Policy — Registry and Services
Registry and service telemetry points to policy awareness and environment reconnaissance rather than noisy persistence. Below is a compact view of the most relevant keys and handles; expand to see the full lists where available.
Registry Opened
47
Registry Set
0
Services Started
0
Services Opened
0
Registry Opened (Top 25)
| Key |
|---|
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Wow64\x86 |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Wow64\x86\xtajit |
| HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US |
| HKEY_LOCAL_MACHINE\Software\Python |
| HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers |
| HKEY_CURRENT_USER\Software\Python\PythonCore\3.9 |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Ole\FeatureDevelopmentProperties |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\MUI\Settings |
| HKEY_CURRENT_USER\Software\Python\PythonCore\3.9\InstallPath |
| HKEY_CURRENT_USER\Software\Python |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\py.exe |
| HKEY_CURRENT_USER\SOFTWARE\Python\PythonCore\3.11\PythonPath |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Python\PyLauncher |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PropertyBag |
| HKEY_LOCAL_MACHINE\SOFTWARE\Python\PythonCore\3.11\PythonPath |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MUI\Settings |
| HKEY_CURRENT_USER\Software\Python\PythonCore\3.11 |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\OLE\Tracing |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\UILanguages\en-US |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\KnownFolderSettings |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\OLE |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1 |
| HKEY_CURRENT_USER\Software\Python\PythonCore |
| HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\Display |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppModel\Lookaside\Packages |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Ole |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Python |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore |
| HKEY_CURRENT_USER\Software\Python\PythonCore\3.11\InstallPath |