Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 20+ hours, this malware remained undetected — a half-day window that permitted the adversary to complete initial execution, establish basic persistence, and perform initial system enumeration.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 72. Detected as malicious: 51. Missed: 21. Coverage: 70.8%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

MITRE ATT&CK Mapping

• T1027 – encode data using ADD XOR SUB operations
• T1543.003 – stop service
• T1489 – stop service
• T1027 – encrypt data using Salsa20 or ChaCha
• T1027 – encode data using XOR
• T1614 – get geographical location
• T1129 – parse PE header
• T1547.001 – persist via Run registry key
• T1027 – reference Base64 string
• T1027 – encrypt data using AES via x86 extensions
• T1543 – Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.
• T1547 – Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.
• T1543.003 – Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
• T1547.001 – Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
• T1548 – Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.
• T1489 – Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
• T1486 – Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
• T1071 – Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
• T1562 – Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.
• T1036 – Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
• T1112 – Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
• T1562.001 – Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.
• T1074 – Adversaries may stage collected data in a central location or directory prior to Exfiltration.
• T1027 – encode data using XOR
• T1547.001 – persist via Run registry key
• T1027 – encrypt data using Salsa20 or ChaCha
• T1027 – encrypt data using AES via x86 extensions
• T1614 – get geographical location
• T1129 – parse PE header
• T1027 – reference Base64 string
• T1543.003 – stop service
• T1489 – stop service
• T1063 – It Tries to detect injection methods
• T1574.002 – Tries to load missing DLLs
• T1547.001 – Creates an autostart registry key
• T1036 – Creates files inside the user directory
• T1497 – Checks if the current process is being debugged
• T1518.001 – Checks if the current process is being debugged
• T1518.001 – May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
• T1518.001 – AV process strings found (often used to terminate AV products)
• T1082 – Reads software policies
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1095 – Downloads files from webservers via HTTP
• T1095 – Posts data to webserver
• T1071 – Downloads files from webservers via HTTP
• T1071 – Posts data to webserver
• T1105 – Downloads files from webservers via HTTP

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.