Dyre

ATP Sandbox Adv. HeuristicsAV

Stats

First seen: April 2022
Last seen: October 2026

Also known as

DyrezaDyzap

MITRE ATT&CK techniques

16 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1140Deobfuscate/Decode Files or Information
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks

TA0007 Discovery

T1007System Service Discovery
T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1082System Information Discovery
T1518Software Discovery

TA0009 Collection

T1074Data Staged
- T1074.001Local Data Staging

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G0102Wizard Spider

Alert name variants

Alert Name	Engine
Gen:Variant.Dyreza.4	AV
Gen:Variant.Dyzap.3	AV
Trojan.Dyreza.Gen.2	AV
Trojan.Dyreza.Gen.3	AV
Win32.Infostealer.Dyre	ATP Sandbox Adv. Heuristics
Win32.Infostealer.Dyreza	ATP Sandbox Adv. Heuristics
Win32.Trojan.Dyreza	ATP Sandbox Adv. Heuristics
Win32.Trojan.Dyzap	ATP Sandbox Adv. Heuristics

Related blogs

Dyre need to secure what matters

Dyre need to secure what matters

September 8, 20143 min read

Related families

QakBot InvisiMole TrickBot PlugX RedLine Stealer