Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 491+ days, this malware remained undetected — an extremely prolonged compromise that provided the adversary extensive opportunity for advanced persistent operations, comprehensive data harvesting, lateral movement across network segments, and sophisticated evasion technique deployment.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 72. Detected as malicious: 38. Missed: 34. Coverage: 52.8%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (46.23% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1105 – download and write a file
• T1547.001 – persist via Run registry key
• T1620 – load .NET assembly
• T1620 – invoke .NET assembly method
• T1016.001 – check Internet connectivity via WinINet
• T1083 – get file version info
• T1134 – modify access privileges
• T1083 – enumerate files in .NET
• T1057 – find process by PID
• T1010 – find graphical window
• T1140 – extract zip archive in .NET
• T1083 – check if file exists
• T1057 – find process by name
• T1564.003 – hide graphical window
• T1134.001 – impersonate user
• T1213 – reference WMI statements
• T1033 – get session integrity level
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1112 – delete registry value
• T1033 – get session user name
• T1087 – get session user name
• T1115 – check clipboard data
• T1082 – query environment variable
• T1057 – get Explorer PID
• T1614 – get geographical location
• T1082 – get OS version in .NET
• T1047 – access WMI data in .NET
• T1027 – encode data using Base64
• T1083 – check if directory exists
• T1012 – query or enumerate registry value
• T1083 – get common file path
• T1012 – query or enumerate registry key
• T1213 – reference SQL statements
• T1027 – encrypt data using DPAPI
• T1115 – read clipboard data
• T1547.009 – persist via lnk shortcut
• T1129 – Adversaries may execute malicious payloads via loading shared modules.
• T1106 – Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
• T1564 – Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
• T1070 – Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.
• T1564.003 – Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
• T1082 – An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
• T1012 – Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
• T1518 – Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.
• T1071 – Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
• T1573 – Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
• T1485 – Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
• T1091 – Checks for available system drives (often done to infect USB drives)
• T1059 – Sample might require command line arguments, analyze it with the command line cookbook
• T1059 – Sample may offer command line options, please run it with the command line option cookbook (it’s possible that the command line switches require additional characters like)
• T1059 – Very long cmdline option found, this is very uncommon (may be encrypted or packed)
• T1547.001 – Creates an autostart registry key
• T1574.002 – Tries to load missing DLLs
• T1036 – Creates files inside the system directory
• T1036 – Creates files inside the user directory
• T1036 – Drops PE files to the windows directory (C:\\Windows)
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1497 – Contains medium sleeps (>= 30s)
• T1497 – Allocates memory with a write watch (potentially for evading sandboxes)
• T1497 – Contains long sleeps (>= 3 min)
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1027.002 – .NET source code contains potential unpacker
• T1070.006 – Binary contains a suspicious time stamp
• T1070.004 – Deletes files inside the Windows folder
• T1518.001 – May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
• T1057 – Queries a list of all running processes
• T1057 – Is looking for software installed on the system
• T1010 – Sample monitors Window changes (e.g. starting applications), analyze the sample with the simulation cookbook
• T1120 – Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook
• T1120 – Checks for available system drives (often done to infect USB drives)
• T1083 – Reads ini files
• T1083 – Enumerates the file system
• T1083 – Writes ini files
• T1082 – Checks the free space of harddrives
• T1082 – Queries the cryptographic machine GUID
• T1082 – Reads software policies
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Is looking for software installed on the system
• T1080 – Infects executable files (exe, dll, sys, html)
• T1115 – Creates a window with clipboard capturing capabilities
• T1036 – Drops files with a non matching file extension (content does not match to file extension)
• T1056 – Creates a DirectInput object (often for capturing keystrokes)
• T1018 – Reads the hosts file

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.