(Proofpoint) The Dreambot malware is still in active development and over the last few months we have seen multiple versions of it spreading in the wild. The Tor-enabled version of Dreambot has been active since at least July 2016, when we first observed the malware successfully download the Tor client and connect to the Tor network. Today, many Dreambot samples include this functionality, but few use it as their primary mode of communication with their command and control (C&C) infrastructure. However, in the future this feature may be utilized much more frequently, creating additional problems for defenders.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
2022-08-08 by Benoît Ancel from Medium CSIS Techblog
2021-01-28 by Benoît Ancel from Youtube (Virus Bulletin)
2020-09-02 by Jordan Herman from RiskIQ
2020-08-28 by Check Point Research from Checkpoint
2020-05-01 by Benoît Ancel from CSIS
2020-02-07 by Benoît Ancel from Medium CSIS Techblog
2017-05-29 by Maciej Kotowicz from Lokalhost.pl
2016-08-29 by Proofpoint Staff from Proofpoint
Tool: DreamBot
Names: DreamBot
Description: (Proofpoint) The Dreambot malware is still in active development and over the last few months we have seen multiple versions of it spreading in the wild. The Tor-enabled version of Dreambot has been active since at least July 2016, when we first observed the malware successfully download the Tor client and connect to the Tor network. Today, many Dreambot samples include this functionality, but few use it as their primary mode of communication with their command and control (C&C) infrastructure. However, in the future this feature may be utilized much more frequently, creating additional problems for defenders.
Category: Malware
Type: Banking trojan, Info stealer, Credential stealer, Botnet
Information: https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
Information: https://lokalhost.pl/gozi_tree.txt
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.dreambot
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=DreamBot
Last-card-change: 2020-05-24
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |