MALICIOUS — 1e7ebe47a5c6a68a1a120f456dde034507c4e6dd9f0cc2b648f087e75f34271b

MALICIOUS — 1e7ebe47a5c6a68a1a120f456dde034507c4e6dd9f0cc2b648f087e75f34271b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dostre family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1e7ebe47a5c6a68a1a120f456dde034507c4e6dd9f0cc2b648f087e75f34271b
SHA-1: da5d3ebe3a6a3f934acf778d5085325edd56645e
MD5: 37f4981a1b8368f00e329f3797eab8dc
imphash: c5723a7c7f3ee77135900804381861ec
ssdeep: 6144:BDjxJR0c6DQMYPIPfU6P8FlZu6PqiLdrqrWPfnJbsLiX1TlF1Zuf0bag46nxdfk:Jj/zNu5qclq
TLSH: T19C499C52280A7334DF393BD06C4AB45D43334AB4E7EC2411ABA3795CA4EB8F35906E56
Submitted as: 1e7ebe47a5c6a68a1a120f456dde034507c4e6dd9f0cc2b648f087e75f34271b
File type: pe · Size: 393216 bytes
Verdict: malicious (99/100) · Family: Dostre

Detections (4 of 56 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Dostre!atmnm
Trellix Stinger (McAfee): Trojan-FPZA!37F4981A1B83
Kaspersky (KVRT): Trojan.Win32.Agent.qwidcl

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

Microsoft Defender flagged Trojan:Win32/Dostre!atmnm (rule Trojan:Win32/Dostre!atmnm) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FPZA!37F4981A1B83 (rule Trojan-FPZA!37F4981A1B83) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.qwidcl (rule Trojan.Win32.Agent.qwidcl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

16554 behavior events · 2 ATT&CK techniques · 23 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\~b4d8\20260823184131_00000029.s - cf5b72d836450ef1821a1cc76f79bbe5a06d02638f47b28ba05a57bec3d10840
C:\Users\analyst\AppData\Local\Temp\~31C6\20260823184126_3.a - 2ccb8b88506e52dbc50a446592cb71c312abe3f7815d9181370117342463462f
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823184149_6.a - ed1847198ce8964325460f2f2fe9db9896695fec3c718836412cbf366cc4e467
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823114254_10.a - d761251a8fa7fe944d45518c7d9edd7c5ef375e48a4390aeb078fcbefd482713
C:\Users\analyst\AppData\Local\Temp\~31C6\20260823184126_2.a - e737f1dccfc3cdf2340d2337b0bce9fa3701d04efb6e0f34e7583e3f617d410d
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823114250_9.a - fb528a8159c62ba35ea9b2064bf691f68bc332363490815612ac55e1446fa1b6
C:\Users\analyst\AppData\Local\Temp\~31C6\20260823184131_4.a - 5aaadd1c8a761ec682ca25237dae6780a67f5932c258614f53eb37e15b116b1c
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823114301_12.a - 9a39ddbab691aa76157f2cf9029b68c5ebd6ce63f041ebc1225b4dc40816b1b0
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823114257_11.a - 73edc7ae54048fef2b5dddd0b9b8196b441205746b369e91bd0178e4daf3ab9a
C:\Users\analyst\AppData\Local\Temp\1787510569.jpg - 9005d3e785777a24caf02db8333a3b872d15852f9578e14b34729d0fd9d748f0
C:\ProgramData\Destro - c2cb291f6bf259e9ec649d7c256ca4890cf672a8e6568bdf2fb422517334535e
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823114309_15.a - 1bacd7ef61ea5bcc12b294e5268a87c1e7ed17da6ab06ec4ea408f6f251cbc50
C:\Users\analyst\AppData\Local\Temp\~31C6\20260823184126_1.a - dfd6e5b3cb3e2d576afbdb1e571dbfa76f332ce41be628bc7c4a8b1dab67b2e1
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823114304_13.a - ffd60a20e8bf095f03c8e69fef916ac253f269424a494865fcbc884a3a3689be
C:\Users\analyst\AppData\Local\Temp\1787535690.jpg - c5e172cd8df8148471cec8bb0197c58810c85656cbdde7094a86e66f257ebaa6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://www.360.cn/status/getsign.asp
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://icanhazip.com/

Embedded domains

www.360.cn
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
icanhazip.com

Embedded IP addresses

4.150.223.96
57.154.63.210
4.230.171.124
4.247.188.224
135.232.92.97
20.184.175.14
52.230.59.222
74.178.76.128
20.42.65.94
52.110.12.24
85.210.193.152
47.89.195.194
20.42.179.192
20.42.65.85
20.42.65.90
52.110.12.48
52.110.12.49
104.16.185.241
206.15.34.59
206.46.188.122
72.145.35.98
52.148.114.188

More Dostre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report