DUSTTRAP

MITRE ATT&CK: S1159 View on attack.mitre.org

Aliases: CurveLoad, DodgeBox, StealthReacher, DUSTTRAP

First seen
2018-01-15 00:00:00
Malware type
backdoor, loader, trojan
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 14:53:21

Targeted industries: government-and-public-sector financial-services healthcare-and-pharmaceutical technology-and-telecommunications

Targeted regions: country_code:us country_code:cn country_code:de country_code:jp

Context

DUSTTRAP is a multi-stage plugin framework associated with APT41 operations with multiple components.

Detection coverage

  • 2 YARA rules
  • 358 Sigma rules

Malware & tools used

  • Group Policy Discovery (attack-pattern)
  • Process Injection (attack-pattern)
  • Keylogging (attack-pattern)
  • Indicator Removal (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Process Discovery (attack-pattern)
  • Local Account (attack-pattern)
  • Screen Capture (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Data from Local System (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Application Window Discovery (attack-pattern)
  • Network Share Connection Removal (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Domain Trust Discovery (attack-pattern)
  • Clear Windows Event Logs (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Embedded Payloads (attack-pattern)
  • Remote System Discovery (attack-pattern)
  • Log Enumeration (attack-pattern)

Used by threat actors

  • APT41 DUST (campaign)
  • APT41 (threat-actor)

Detection rules

  • SEKOIA_Loader_Win_Dodgebox (yara-rule)
  • MALPEDIA_Win_Dusttrap_Auto (yara-rule)

Reports & references

  • cloud.google.com — Apt41 Arisen From Dust (report)
  • zscaler.com — Dodgebox Deep Dive Updated Arsenal Apt41 Part 1 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Dusttrap (report)
  • cloud.google.com — Apt41 Arisen From Dust (report)
  • MITRE ATT&CK — S1159 (report)

External references