MALICIOUS — d089e07cdb31b86db82c0c8fb4d46ffa2e4bf3577529be8a97a29d3245d8250b
MALICIOUS — d089e07cdb31b86db82c0c8fb4d46ffa2e4bf3577529be8a97a29d3245d8250b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Dostre family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
d089e07cdb31b86db82c0c8fb4d46ffa2e4bf3577529be8a97a29d3245d8250b - SHA-1:
8fc62e798eaa070f273da789e37ff423c3ae0aad - MD5:
18139709e9f628e9cc5daa780bbbf461 - imphash:
c5723a7c7f3ee77135900804381861ec - ssdeep:
3072:n8CA3ceLcO4rrkpUVATuNrHASmGUv+srsmAfJqoVVywDYTdAhJiAlk:3ZbXu1v+cszfJqWPc5AXs - TLSH:
T1DE498CC189AEB030C9335B4D1A68B30C9D79C983B49C2154AB9BE4AF75CBF734250679 - Submitted as: d089e07cdb31b86db82c0c8fb4d46ffa2e4bf3577529be8a97a29d3245d8250b
- File type: pe · Size: 393216 bytes
- Verdict: malicious (84/100) · Family: Dostre
Detections (4 of 55 engines)
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Dostre!atmnm
- Trellix Stinger (McAfee): Trojan-FPZA!18139709E9F6
- Kaspersky (KVRT): Trojan.Win32.Agent.qwidcl
MITRE ATT&CK
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Contacted 31 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
20009 behavior events · 1 ATT&CK techniques · 18 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- www.360.cn
- icanhazip.com
- c.pki.goog
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\~BB43\20260819182300_9.a -
9d659c8f279d4f2e583b7daba2ca7ac1f561bb125e0b8c891886e4d0c8c68ce9 - C:\Users\analyst\AppData\Local\Temp\~BB43\20260819182304_10.a -
655e86cc98aa3d59799034dfd7f9377e6003c5de15df6d3aa4d605a9a5aeac75 - C:\Users\analyst\AppData\Local\Temp\~31C6\20260820012131_1.a -
ccfcd869093ea7e24b92bc6ab57add2deb716c8aa01eaac72f6b293f9b52bdc7 - C:\Users\analyst\AppData\Local\Temp\~BB43\20260820012201_6.a -
f2d1360dbfed07038da6119c24350bf49dbcff8629a107493ecc1a0baa840efc - C:\Users\analyst\AppData\Local\Temp\tsk_dfe64c1bb0444042.exe -
1e7dc10d985ba82a972b24ca4df636c816457be1f3d0e0fe843e4eedb2ae570b - C:\Users\analyst\AppData\Local\Temp\~BB43\20260820012157_5.a -
cc4c794013c307441e589117e2503bfc5b7e3266695fe03d52e16bde1d8e7f62 - C:\Users\analyst\AppData\Local\Temp\1787188969.jpg -
5be67c4e8c59cfabafe422ee7b8a0c51d810c9e1438d9ebbf22c4108424ce643 - C:\ProgramData\Destro -
c2cb291f6bf259e9ec649d7c256ca4890cf672a8e6568bdf2fb422517334535e - C:\Users\analyst\AppData\Local\Temp\~31C6\20260820012133_3.a -
e992213dff7f8ee4206d3ae1fe72ed3dcc9cbf61e19957f51e0ab72a7e8e3fa7 - c:\users\analyst\appdata\local\temp\~b4d8\20260820012141_00000029.s -
ecbc782ad4b142a432ad4e2d11860137c79facc7cfff5af15d0661fed8dacf7d - C:\Users\analyst\AppData\Local\Temp\1787214096.jpg -
46fb77d0794ecfcac040886460602668fb5cda55299a5d1070db5d0c746b54b6 - C:\Users\analyst\AppData\Local\Temp\~31C6\20260820012131_2.a -
6f9eff313fcda971113ed2ea527ce18d0aa82d34ca2184d2555478f19c828ea7 - C:\Users\analyst\AppData\Local\Temp\~BB16\C -
df4743ae2a01db72b206db4b4ca48c5c6ae998fbbc9dbf0e11dc7c819c0f7da1 - C:\Users\analyst\AppData\Local\Temp\~BB43\20260819182316_12.a -
e9deccb9be98aaf27663d9f6a88159d9558a903f8d470f51d34ed2c6baa83b40 - C:\Users\analyst\AppData\Local\Temp\~BB43\20260819182255_8.a -
2f7250556c9ec156e39894ec305b65463a099b4941fe096da296bf8e25d93c51
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787793669&P2=404&P3=2&P4=JDVC%2fvvoHjemXwsE9H46ltwEerpozjSKYuG8CHsKNwfQFPeB0Bc8vmYO5fzhzWZPW5OStFRgnaUTtgX%2fZUj7jA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787793711&P2=404&P3=2&P4=J62UJO5uCFZFubuW83Ojkix3Ff0VmlMaVIsGhcNu38XHIG7OTzvyrD1udPQ5SE%2fuBBAWTCRHXuABwf9OufWG3g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://www.360.cn/status/getsign.asp
- http://icanhazip.com/
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
Embedded domains
- www.360.cn
- icanhazip.com
Embedded IP addresses
- 52.123.252.226
- 20.50.201.195
- 20.42.179.192
- 4.230.171.124
- 57.155.104.224
- 4.144.132.223
- 74.178.76.128
- 52.123.252.243
- 4.150.223.114
- 74.178.240.51
- 20.231.239.246
- 52.123.128.14
- 52.123.129.14
- 52.123.252.231
- 135.234.160.244
- 203.26.79.13
- 52.123.252.240
- 135.233.95.80
- 52.123.252.229
- 52.123.252.239
- 52.110.12.19
- 52.148.114.188
- 47.89.195.194
- 72.145.35.105
- 203.122.93.116
More Dostre samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report