{
  "family": "dothetuk",
  "sample_count": 51,
  "category": "infostealer",
  "description": "Dothetuk (cataloged across security vendors and threat intelligence databases under signatures including Trojan:MSIL/Dothetuk.A, Adware:Win32/Dothetuk, and Spyware.Dothetuk) is a hybrid .NET MSIL infostealer, spyware, and adware framework active since 2017. Disseminated primarily through deceptive software bundlers, cracked applications, and weaponized email attachments, Dothetuk executes dual-purpose malicious routines. On infected systems, the malware establishes persistence through registry run entries, captures desktop screenshots, logs keystrokes, and extracts cached credentials from web browsers. Concurrently, Dothetuk modifies web browser shortcuts and injects intrusive affiliate advertisements to monetize traffic while exfiltrating harvested user credentials to remote attacker-controlled servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:MSIL/Dothetuk.A",
    "Adware:Win32/Dothetuk",
    "Spyware.Dothetuk",
    "Win32/Dothetuk",
    "MSIL.Dothetuk"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:MSIL/Dothetuk.A?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dothetuk is a .NET-based information stealer and adware trojan that steals credentials, captures keystrokes, and injects ads."
      }
    },
    {
      "@type": "Question",
      "name": "What sensitive information does Dothetuk harvest from victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It harvests browser passwords, typed keystrokes, desktop screenshots, and system configuration data."
      }
    },
    {
      "@type": "Question",
      "name": "How is Dothetuk distributed to endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through bundled third-party freeware installers, deceptive software cracks, and malicious email links."
      }
    },
    {
      "@type": "Question",
      "name": "Does Dothetuk modify web browser settings?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it modifies browser shortcut arguments and defaults to redirect traffic through affiliate ad networks."
      }
    },
    {
      "@type": "Question",
      "name": "How can victims eliminate Dothetuk from an infected system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run an offline scan with Microsoft Defender, reset web browser shortcuts, and change critical account passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.003",
    "T1056.001",
    "T1113",
    "T1185",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Software Cracks & Keygens",
    "Phishing Email Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Web Browser Credential Extraction",
    "Desktop Screenshot Capture",
    "Keystroke Logging (Keylogger)",
    "Browser Shortcut Redirection",
    "Encrypted Telemetry Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      ".NET MSIL Assembly",
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "HTTP POST beacons transmitting zipped credential dumps and screenshots to C2 servers",
      "Affiliate tracking URL redirects during web browsing sessions"
    ],
    "evasion_techniques": [
      "Obfuscating .NET source code using ConfuserEx or similar protectors",
      "Simultaneously executing adware behavior to mask underlying spyware activity"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "d1dc8f781bb49f8b15df726489312bcf8194ad92",
      "71649275819385920a19e48b3b42f2b3e449a572"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DothetukService"
    ],
    "file_paths": [
      "%AppData%\\Dothetuk\\dothetuk.exe",
      "%Temp%\\screen_cap.tmp"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Enforce multi-factor authentication (MFA) to mitigate impact of stolen browser credentials",
    "Deploy endpoint behavioral rules detecting unauthorized keystroke hooking (SetWindowsHookEx)"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:MSIL/Dothetuk.A",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:MSIL/Dothetuk.A"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:MSIL/Dothetuk.A",
      "Adware:Win32/Dothetuk"
    ]
  },
  "motivation": "Financial Crime, Credential Harvesting & Advertising Monetization",
  "sample_hashes": []
}