user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat VirTool:MSIL/Aikaantivm!atmn
VirTool:MSIL/Aikaantivm!atmn - Windows Defender threat signature analysis

VirTool:MSIL/Aikaantivm!atmn - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: VirTool:MSIL/Aikaantivm!atmn
Classification:
Type:VirTool
Platform:MSIL
Family:Aikaantivm
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!atmn
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Virus Tool - Tool used to create or modify malware for .NET (Microsoft Intermediate Language) platform, family Aikaantivm

Summary:

VirTool:MSIL/Aikaantivm!atmn is a malicious .NET-based tool designed to evade analysis by detecting virtual machines and sandboxes. It establishes persistence through registry Run keys and Scheduled Tasks, and uses legitimate Windows utilities like PowerShell and Rundll32 to execute malicious commands and hook system functions.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - Software\Microsoft\Windows\CurrentVersion\Run (PEHSTR_EXT)
 - Select * from Win32_ComputerSystem (PEHSTR_EXT)
 - SbieDll.dll (PEHSTR_EXT)
 - cmdvrt32.dll (PEHSTR_EXT)
 - SxIn.dll (PEHSTR_EXT)
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
No specific strings found for this threat
YARA Rule:
rule VirTool_MSIL_Aikaantivm_GG_2147769553_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "VirTool:MSIL/Aikaantivm.GG!MTB"
        threat_id = "2147769553"
        type = "VirTool"
        platform = "MSIL: .NET intermediate language scripts"
        family = "Aikaantivm"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_PEHSTR_EXT"
        threshold = "73"
        strings_accuracy = "High"
    strings:
        $x_10_1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii //weight: 10
        $x_10_2 = "Select * from Win32_ComputerSystem" ascii //weight: 10
        $x_10_3 = "microsoft corporation" ascii //weight: 10
        $x_10_4 = "VIRTUAL" ascii //weight: 10
        $x_10_5 = "vmware" ascii //weight: 10
        $x_10_6 = "VirtualBox" ascii //weight: 10
        $x_10_7 = "SbieDll.dll" ascii //weight: 10
        $x_1_8 = "cmdvrt32.dll" ascii //weight: 1
        $x_1_9 = "SxIn.dll" ascii //weight: 1
        $x_1_10 = "WriteProcessMemory" ascii //weight: 1
        $x_1_11 = "NtUnmapViewOfSection" ascii //weight: 1
        $x_1_12 = "VirtualAllocEx" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (
            ((7 of ($x_10_*) and 3 of ($x_1_*))) or
            (all of ($x*))
        )
}
Known malware which is associated with this threat:
Filename: System.Service.exe
fc9003092baa0c5121ef92753ac46c2372620f423fa700896b52ae1413ebe75d
04/12/2025
→VirusTotal↓Download Sample
Filename: stub.exe
0b5c1b777491d7f267bdb5b1eb6e687323799f85ea5eac44f3db11a84c7f505c
04/12/2025
→VirusTotal↓Download Sample
Filename: Pulsar-Client.exe
3df1c2d8cb6357dec23ffe7083d6058c300419519ee7b34efcfba3a0384ea08b
16/11/2025
→VirusTotal↓Download Sample
e6a5b25f6908df2812d77e1b071f71002eae1c6584da91bbb571d073c2ec2c6b
16/11/2025
→VirusTotal↓Download Sample
Filename: PClient.exe
2b782927fc933eae5dcc58fe16cd941d2c29bf9dd3f89f0d69af73404abaef70
14/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected machine from the network. Use antivirus software to remove the detected threat and run a full system scan. Manually inspect and remove persistence mechanisms in registry Run keys and Scheduled Tasks. Investigate for further compromise; consider re-imaging the system.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 09/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊