user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:Win32/Suschil!rfn
Trojan:Win32/Suschil!rfn - Windows Defender threat signature analysis

Trojan:Win32/Suschil!rfn - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:Win32/Suschil!rfn
Classification:
Type:Trojan
Platform:Win32
Family:Suschil
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!rfn
Specific ransomware family name
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for 32-bit Windows platform, family Suschil

Summary:

Trojan:Win32/Suschil!rfn is a multi-functional trojan that leverages numerous 'living-off-the-land' binaries (mshta, rundll32, PowerShell) for execution and evasion. It establishes persistence via scheduled tasks and BITS jobs and employs API hooking, indicating capabilities for system control, data theft, or deploying additional malware.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: Shipping Doc.docx
4e806d94ee7e7340fd0e0f8bb43dd96b0d738b08f17a1ba9e12b296f5006fb18
09/12/2025
→VirusTotal↓Download Sample
Filename: ImGui.zip
36d3b0214cb5431b133eb6ccf3ef77e32471e97860e9f021f3fb6a1bec6182e7
03/12/2025
→VirusTotal↓Download Sample
90aed3a3ddbc2db90f49c66d5ad2b39863f4f340aa22187179402f4023fa75c2
02/12/2025
→VirusTotal↓Download Sample
Filename: uyoaspmbnq.zip
dade86ed869c090f4b546e1e87df6e4aaff34243611ec24884c9094b77668288
18/11/2025
→VirusTotal↓Download Sample
Filename: Seattle House.exe
d3cbcd81a249212c42c752454e7b704f4b0da63f30b142ed08b60c614c91c248
17/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the endpoint from the network immediately. Use Windows Defender or another endpoint security solution to perform a full scan and remove the threat. Manually inspect and remove suspicious scheduled tasks, BITS jobs, and startup entries. Due to the high risk of compromise, a full system reimage is strongly recommended.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 13/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊