MALICIOUS — f451b754985f4d16c8ba9f3223a0f7b4b7a125531247b931df86172a93141890

MALICIOUS — f451b754985f4d16c8ba9f3223a0f7b4b7a125531247b931df86172a93141890 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dostre family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: f451b754985f4d16c8ba9f3223a0f7b4b7a125531247b931df86172a93141890
SHA-1: 6f31120713e9848af5aed9d9be6928a630529c80
MD5: 0536f76005293076a71de2885e6382ec
imphash: c5723a7c7f3ee77135900804381861ec
ssdeep: 3072:n8CYRJ9VXbkOSe0u5Yt87LPvdtlcx4xbQbA4jCuFWzk+mcZXsZdCqchFRjoOqRc:iRJ9VXAC0NqvPvda1x0GdUj9oOYce
TLSH: T1D6497CD17D6BB3B8E97D27005C598B4C23199C8CB6EF15162313628DE0CB47F9BA0A64
Submitted as: f451b754985f4d16c8ba9f3223a0f7b4b7a125531247b931df86172a93141890
File type: pe · Size: 393216 bytes
Verdict: malicious (99/100) · Family: Dostre

Detections (4 of 56 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Dostre!atmnm
Trellix Stinger (McAfee): Trojan-FPZA!0536F7600529
Kaspersky (KVRT): Trojan.Win32.Agent.qwidcl

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

Microsoft Defender flagged Trojan:Win32/Dostre!atmnm (rule Trojan:Win32/Dostre!atmnm) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FPZA!0536F7600529 (rule Trojan-FPZA!0536F7600529) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.qwidcl (rule Trojan.Win32.Agent.qwidcl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

16981 behavior events · 2 ATT&CK techniques · 23 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\~b4d8\20260824003649_00000029.s - 18bd996f501a82b7d6611f344b4323880d5d185055604c567e51900b5f97cac7
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823173823_12.a - 5f800f7944a3de68fa94e4163e2509df6648ee522701c15951cdfacbe5edb200
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823173812_9.a - 2f974cb33e691cdb9e1df6a639d2cfa2ab1a88b071e239ca6040a2adb6657588
C:\Users\analyst\AppData\Local\Temp\~31C6\20260823173827_14.a - e2bb8e02a31db687bf6346457178b0189de82d232d90bc6cf4135961d3d6a3e5
C:\Users\analyst\AppData\Local\Temp\~BB43\20260824003707_6.a - 65694ce6b4aa106dbf5cabdeeac7e810bb77ce2fa0b4f20fd7a5c649ab653cab
C:\Users\analyst\AppData\Local\Temp\~31C6\20260824003644_3.a - aa266f6ad5456b872c879682b7286cc4e1c453d95beacb1c3698ec3680e13fe9
C:\Users\analyst\AppData\Local\Temp\~BB43\20260824003703_5.a - fd1dd5bc97e76ee8313f71dcec065c3d36b6388bbee53e26b3f99f66c80afd7e
C:\Users\analyst\AppData\Local\Temp\~31C6\20260824003643_2.a - f2918d43a5caed2a7625f92cc757020053a69ac6b8c415c15dd4c17201d3017e
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823173832_15.a - 4bb90203bcc62452877490419d265fa3e66296224eeb6f7735418184bf7193fd
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823173820_11.a - 0a1b163293e39975c8344f23fe80d80c6ebf68ff6cf80bf28411a9e75e3065b6
C:\ProgramData\Destro - c2cb291f6bf259e9ec649d7c256ca4890cf672a8e6568bdf2fb422517334535e
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823173809_8.a - 20b3013b2b1775a7b895d4c82866fc6049a060d87cab1ec6c25721367e2076d4
C:\Users\analyst\AppData\Local\Temp\~BB43\20260823173817_10.a - 7664b1d9fb89b7e151aeac8f4e3d6810d615f4252cb26b0c0d82a66e52129beb
C:\Users\analyst\AppData\Local\Temp\1787531891.jpg - bc131de6b0f0e6e9127c9994439a5c111466337cbe0059ad6dd4d3db407e0f68
c:\users\analyst\appdata\local\temp\~b4d8\20260823173811_00004823.s - 18a4caaa7a5367aec7def6f25fc1401a9520b5c8a9109d545583b9d4cd38959a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://www.360.cn/status/getsign.asp
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://icanhazip.com/

Embedded domains

www.360.cn
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
icanhazip.com

Embedded IP addresses

20.42.73.25
4.230.171.124
4.144.132.114
57.154.63.210
135.232.92.137
74.178.240.51
20.184.175.13
20.42.73.24
172.64.154.167
20.42.179.192
4.150.223.109
20.42.65.94
47.89.195.194
52.110.12.48
52.110.12.18
52.148.114.188
104.16.184.241
211.40.175.10
72.153.5.63
211.54.14.75

More Dostre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report