MALICIOUS — c71c8bb9cfb39367ef78e7a7aeec779d2558d90acfb7e51f0de90a5a39cac332

MALICIOUS — c71c8bb9cfb39367ef78e7a7aeec779d2558d90acfb7e51f0de90a5a39cac332 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Dostre family. 4 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: c71c8bb9cfb39367ef78e7a7aeec779d2558d90acfb7e51f0de90a5a39cac332
SHA-1: cfdb637006ad03d31320a6a3ea7238b801c5da08
MD5: 834c41735fdd2dd8ce0fc3e4e24d7058
imphash: c5723a7c7f3ee77135900804381861ec
ssdeep: 6144:byvLsAWqEmEBJWoENv2XzsF0UXWR+ruM611N:bVAWVm0vz+XI+ruMUN
TLSH: T1524969B40813721CC974D890E9D4812C9155CAB8445C8AFF3FC7A69EE7CBA3BA077625
Submitted as: c71c8bb9cfb39367ef78e7a7aeec779d2558d90acfb7e51f0de90a5a39cac332
File type: pe · Size: 393216 bytes
Verdict: malicious (93/100) · Family: Dostre

Detections (4 of 55 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Dostre!atmnm
Trellix Stinger (McAfee): Trojan-FPZA!834C41735FDD
Kaspersky (KVRT): Trojan.Win32.Agent.qwidcl

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 8 weighted signals:

Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (29 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

19266 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~BB43\20260821054819_6.a - 3894d7d05a24508959393ada23d315098835c415188e3881e05bb0fad65be672
C:\Users\analyst\AppData\Local\Temp\~BB43\20260821054816_5.a - fa5b64dce2ccf74f5235cffea4529c5326de99bedc37f73a20c2baf4383e6d28
C:\Users\analyst\AppData\Local\Temp\~BB16\C - ed0abdac91f5832878a521e8e9ed5272bb725c945edcfe47d5e3ee1668adae07
C:\Users\analyst\AppData\Local\Temp\~BB43\20260821054823_7.a - b0d03aee4025e03b463a114cab5645baa25e234ba9e251de427ec89ace29f7e8
C:\ProgramData\Destro - c2cb291f6bf259e9ec649d7c256ca4890cf672a8e6568bdf2fb422517334535e
c:\users\analyst\appdata\local\temp\~31c6\20260821054807_4.a - c4c984af8f8f1c2925e17ee250f61ec03e5a6beef31e4f1c6037c6f2cfb7664d
C:\Users\analyst\AppData\Local\Temp\~31C6\20260821124641_1.a - fb2591df0ce7a5155cbf5dc7ddb0647ad7a8757732c6515a4fb6e35cf137f421
C:\Users\analyst\AppData\Local\Temp\~BB43\20260821054834_10.a - 3fd5cd64fd771ee750fabebb828804fd77baa81d939949af2805a5b38bd6d385
C:\Users\analyst\AppData\Local\Temp\~31C6\20260821124641_2.a - 015705fccd854c286addb6dfa5af0cb393cd51d923d2301571f8aa1ded36e654
C:\Users\analyst\AppData\Local\Temp\~BB43\20260821054830_9.a - 3ce176d9c6be0270c96a3d8f14085d17c4acaf5e1bbd0813b692bbf5bbf1057e
C:\Users\analyst\AppData\Local\Temp\~31C6\20260821124646_3.a - 578e56166991fc9b99cfd00f0ba42ecffbbbb7bcdd7b11c6435db6b3a79de062
C:\Users\analyst\AppData\Local\Temp\tsk_cef43679b33a435f.exe - e2a0543b02489df0c59485032fcef99b141bc36c97844e3dac8916e599ba1d9f
C:\Users\analyst\AppData\Local\Temp\1787341606.jpg - 888b6e54fe6d30e959b38300ad95be48c4c0f468a72d6751a32b32c371d0baa6
C:\Users\analyst\AppData\Local\Temp\~BB43\20260821054826_8.a - afd979bdd8949399d3152141e6761481a4833a07e06e909ab007fe46028db887
af29e7543dd8b8cda0630a4b06c1480b41510ed2c0a3aff0e9d0d6fe11a64777 - af29e7543dd8b8cda0630a4b06c1480b41510ed2c0a3aff0e9d0d6fe11a64777

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787921160&P2=404&P3=2&P4=gIa1r7fnkndOl5BaFN2wuTofoI6y86NU5gp36iQ33AcKvycPySzUifOo5G%2bVA81RGY93xscStuSHG%2fqaS%2fVtzQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787921231&P2=404&P3=2&P4=YQjs2%2bXzDpg0tFr2s77XuXLpqGZTiKgsCP%2fDHa%2bWV4UtqjDiCoyFdDiN8r%2fXYwxzY27FVLbTMDpNECgP9LJCPQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://www.360.cn/status/getsign.asp
http://icanhazip.com/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

www.360.cn
icanhazip.com

Embedded IP addresses

57.154.63.210
20.42.73.25
52.230.60.54
4.230.171.124
20.165.94.63
20.184.175.21
74.178.240.51
85.210.193.152
20.236.44.162
40.99.133.226
52.123.129.14
52.123.128.14
203.26.79.13
74.179.71.159
92.223.78.30
162.159.142.9
172.178.240.163
52.110.12.44
52.110.12.32
52.148.114.188
47.89.195.194
72.145.35.103
208.20.251.78
208.34.90.15
52.110.12.30

File paths

G:\9[

More Dostre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report