{
  "family": "dovs",
  "sample_count": 75,
  "category": "trojan",
  "description": "Dovs (cataloged in antivirus vendor databases under detections including Trojan:Win32/Dovs, TrojanDownloader:Win32/Dovs, and Win32/Dovs) is a stealthy Windows trojan downloader active since 2013. Engineered to serve as an initial access and payload delivery stager, Dovs typically infiltrates systems via malicious email attachments, cracked software packages, or exploit kits. Upon execution, Dovs decrypts embedded configuration parameters, verifies host network connectivity, and reaches out to hardcoded remote command-and-control (C2) servers over HTTP or HTTPS. It downloads secondary malicious executables—such as credential stealers, cryptocurrency miners, or rogue security software—saving them into temporary directories like %Temp% or %AppData% with randomly generated filenames. Dovs establishes persistence by modifying Windows registry Run keys or configuring scheduled tasks to ensure automatic reactivation across reboots.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Dovs",
    "TrojanDownloader:Win32/Dovs",
    "Win32/Dovs"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Dovs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dovs is a Windows trojan downloader that retrieves and installs secondary malicious payloads from remote servers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dovs deliver secondary malware onto an infected PC?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It connects to remote C2 servers via HTTP, downloads encrypted payloads into %Temp%, and executes them silently."
      }
    },
    {
      "@type": "Question",
      "name": "What mechanisms does Dovs use to maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dovs writes autostart entries to the Windows Run registry keys and schedules background tasks."
      }
    },
    {
      "@type": "Question",
      "name": "What types of threats are dropped by Dovs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently drops information stealers, coin miners, click-fraud utilities, and ransomware precursors."
      }
    },
    {
      "@type": "Question",
      "name": "How can network administrators detect and eliminate Dovs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor anomalous outbound HTTP downloads from %Temp% paths, inspect scheduled tasks, and perform an endpoint AV scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1566.001",
    "T1547.001",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies (ExtensionInstallForcelist) created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Dovs frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; scareware campaigns can trick employees into providing corporate credit card details or remote access to fake 'support' agents."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Initial Access & Malware Distribution",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Weaponized Documents",
    "Cracked Software & Keygens",
    "Drive-by Exploit Kits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Downloading",
    "Registry Autostart Persistence",
    "System Information Harvesting",
    "Temporary File Execution",
    "Encrypted HTTP C2 Beaconing"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests to remote IP addresses fetching binary payloads",
      "User-Agent spoofing mimicking common desktop browsers"
    ],
    "evasion_techniques": [
      "Dropping payloads into randomized subdirectories in %Temp%",
      "Sleep timers to bypass sandbox automated analysis"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DovsUpdater",
      "Windows Task Scheduler jobs running under %AppData%"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Unauthorized software installation, secondary threat execution, network bandwidth consumption"
  },
  "lineage": {
    "derived_from": [
      "Win32 Trojan Downloader Toolkits"
    ],
    "variants": [
      "Dovs.A",
      "Dovs.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4",
      "f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5"
    ],
    "delivery": [
      "setup_dovs.exe",
      "update_patch.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DovsService",
      "%Temp%\\dovs_loader.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Dovs",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dovs"
    },
    {
      "name": "Fortinet FortiGuard Labs - Threat Encyclopedia: Win32/Dovs",
      "url": "https://www.fortiguard.com"
    }
  ]
}