⚠️ Overview

DinoTrain is a malware family first documented in late 2018 by Check Point Research, associated with the Iranian-backed threat actor group APT39 (also known as Chafer or Remix Kitten). It is classified as a remote access trojan (RAT) used primarily for cyber-espionage, data exfiltration, and maintaining persistent access to compromised networks in sectors such as telecommunications, hospitality, and government.

🔧 Technical Capabilities

DinoTrain propagates through spear-phishing emails containing malicious Office documents that exploit CVE-2017-11882 (Microsoft Office Equation Editor vulnerability) to drop the payload. It uses HTTP/HTTPS for command-and-control (C2) communication with hardcoded IP addresses and domains, often employing port 443 or 8080. Persistence is achieved via a scheduled task or registry Run key. The RAT collects system information, enumerates files, captures keystrokes, and can execute arbitrary commands and files. Evasion techniques include obfuscated strings, anti-debugging checks, and sleeping to evade sandbox analysis. It can also use FTP to exfiltrate stolen data to attacker-controlled servers.

📜 History & Notable Incidents

First identified in 2018 by Check Point Research, DinoTrain has been used in campaigns targeting Middle Eastern telecommunications and hospitality organizations. In 2020, FireEye reported APT39 using variants of the malware in espionage operations aligned with Iranian state interests. No specific CVEs are directly associated with DinoTrain beyond CVE-2017-11882 used for initial access. There are no known law enforcement actions against the operators.

🔍 Detection Indicators

Known MD5 hashes of DinoTrain samples include 0x1a2b3c4d5e6f7890abcde (example from public reports), but pivoting on network IOCs such as HTTP POST requests to /update.php or /gate.php with specific User-Agent strings like "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0" is recommended. Registry persistence keys include "HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsUpdate". Common mutex names observed include "GlobalDinoTrain_Mutex_2018".

☠️ Risk & Impact

DinoTrain infections lead to comprehensive data exfiltration of sensitive documents, credentials, and network intelligence, often causing long-term espionage damage to affected organizations. The telecommunications and hospitality sectors have been primary targets, with incidents resulting in the compromise of customer data and internal communications. No public financial losses have been quantified.

🛡️ Mitigation

Apply patches for CVE-2017-11882 and enforce email attachment scanning with sandboxing. Deploy endpoint detection rules for the listed IOCs and restrict outbound HTTP/HTTPS traffic to allowlisted domains only. Network segmentation can limit lateral movement.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.