{
  "family": "dynamer",
  "sample_count": 110,
  "category": "trojan",
  "description": "Dynamer (cataloged across security telemetry as Trojan:Win32/Dynamer, Trojan:Win32/Dynamer!ac, Trojan:Win32/Dynamer!rfn, and Trojan.Win32.Dynamer) is a prevalent Microsoft Defender behavioral detection classification active since 2013. Designed to flag high-risk generic trojan routines, Dynamer signatures intercept executables that display deceptive execution behaviors—such as packed binary headers, reflective code loading, process injection into legitimate Windows binaries (like svchost.exe), and covert command-and-control polling. In wild infections, Dynamer variants typically manifest through trojanized software cracks, key generators, and pirated media bundles. In corporate forensic investigations, the Dynamer signature is also widely recognized by systems administrators as a frequent false-positive trigger against dormant OEM factory recovery partitions (such as HP or Lenovo D:\\preload\\ or install.wim image files) containing legacy bundled software. When executing maliciously, Dynamer establishes registry run key persistence and serves as a modular stager for credential stealers and secondary botnet payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Dynamer",
    "Trojan:Win32/Dynamer!ac",
    "Trojan:Win32/Dynamer!rfn",
    "Trojan.Win32.Dynamer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Dynamer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dynamer is a Microsoft Defender trojan detection signature identifying suspicious, obfuscated Windows executables exhibiting payload injection behavior."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Dynamer often detected in computer recovery partitions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Heuristic engines frequently misidentify archived OEM recovery tools and legacy pre-installed utilities inside .wim images as Dynamer."
      }
    },
    {
      "@type": "Question",
      "name": "How does malicious Dynamer malware compromise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through trojanized software cracks, keygens, and pirated installers that drop packed executables into user temporary directories."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious actions does Dynamer perform upon execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hollows or injects code into native Windows processes, establishes autostart persistence, and downloads secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise respond to a Dynamer detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Verify file location: if in active user folders, isolate and reimage the endpoint; if in factory recovery partitions, verify image integrity."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1129",
    "T1497.001",
    "T1055",
    "T1620",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1620",
      "name": "Reflective Code Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1129",
      "name": "Shared Modules",
      "tactic": "Execution"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Determine the detection file path: if located in %Temp% or %AppData%, isolate the host immediately.",
    "Capture a volatile memory image to evaluate whether injected memory threads are communicating with external C2 addresses.",
    "Verify whether the detection is an OEM recovery false positive before executing destructive disk format actions.",
    "Scan the entire endpoint with an offline antimalware scanner to identify any secondary dropped backdoors."
  ],
  "what_to_avoid": [
    "Do not assume the alert is automatically a false positive without verifying the file path and execution context.",
    "Avoid running unvetted software cracks or game keygens in corporate environments, as they represent the primary real-world delivery vector."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Consumer Endpoints",
    "Enterprise Workstations"
  ],
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "lineage": {
    "derived_from": [
      "Generic Windows Trojan Signatures"
    ],
    "variants": [
      "Dynamer.A",
      "Dynamer!ac",
      "Dynamer!rfn"
    ]
  },
  "iocs": {
    "file_hashes": [
      "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b",
      "5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c"
    ],
    "delivery": [
      "Trojanized software cracks and key generators",
      "Deceptive freeware downloads and peer-to-peer torrents"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DynamerService",
      "Scheduled Task launching dropped payload from %AppData%"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Dynamer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dynamer"
    },
    {
      "name": "BleepingComputer Technical Advisory - Dynamer False Positive Analysis",
      "url": "https://www.bleepingcomputer.com/news/security/trojan-win32-dynamer-detection-in-recovery-partitions/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}