{
  "family": "dostre",
  "sample_count": 35,
  "category": "trojan",
  "description": "Dostre (identified across security telemetry and antivirus engines as Trojan:Win32/Dostre, Ransom:Win32/Dostre, and Trojan.Dostre) is a multi-stage Windows trojan and initial compromise agent active since 2016. Frequently distributed through spam email attachments, malicious software keygens, and compromised torrent distributions, Dostre establishes an initial foothold by deploying heavily obfuscated stubs into hidden user directories. Dostre conducts immediate host discovery—querying local hardware specifications, active antivirus processes, and network interfaces—before communicating with remote C2 servers via encrypted HTTP beacons. Depending on instructions returned from the C2 infrastructure, Dostre can act as an extortion screen locker, deploy secondary ransomware modules, or inject backdoor routines into native Windows processes like svchost.exe to establish long-term persistence.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Dostre",
    "Ransom:Win32/Dostre",
    "Trojan.Dostre",
    "Win32/Dostre",
    "Trojan:Win32/Dostre.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Dostre?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dostre is a multi-stage Windows trojan and initial access threat that delivers secondary malware payloads and extortion routines."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dostre maintain persistence on infected systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows CurrentVersion\\Run registry keys and registers background service tasks to re-launch upon system boot."
      }
    },
    {
      "@type": "Question",
      "name": "What evasive tactics are implemented by Dostre?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dostre inspects the Process Environment Block for debuggers, terminates security processes, and injects code into svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dostre communicate with its command and control servers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It issues encrypted HTTP POST requests carrying host reconnaissance profiles and downloads secondary binaries disguised as temporary data files."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures effectively mitigate Dostre?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce behavioral monitoring on svchost.exe process injections, restrict executable launches from %AppData%, and maintain current antivirus definitions."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1071.001",
    "T1486",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "P2P Torrent Downloads & Keygens",
    "Compromised Software Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted HTTP C2 Beaconing",
    "Process Injection into svchost.exe",
    "Extortion Screen Locking Routines",
    "System Telemetry Enumeration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST requests carrying RC4-encrypted system identifiers and installed AV product listings",
      "Direct downloads of secondary stage binary payloads masquerading as temporary data files"
    ],
    "evasion_techniques": [
      "Anti-debugging loops querying PEB BeingDebugged flags",
      "Terminating security services and disabling Windows Defender real-time monitoring via registry modifications"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "d3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2",
      "e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DostreService",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DostreAgent"
    ],
    "file_paths": [
      "%AppData%\\Dostre\\dostresvc.exe",
      "%Temp%\\dst_temp.dat",
      "%ProgramData%\\Dostre\\config.bin"
    ]
  },
  "defensive_measures": [
    "Monitor process injection events into svchost.exe using Sysmon or enterprise EDR agents",
    "Block unauthorized modifications to Windows Defender security settings in the registry",
    "Inspect perimeter web traffic for abnormal encrypted HTTP traffic to unregistered IP addresses"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Dostre",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dostre"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Dostre",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Dostre.A",
      "Ransom:Win32/Dostre.B"
    ]
  },
  "motivation": "Initial Compromise, Extortion & Secondary Malware Deployment",
  "sample_hashes": []
}