Tuesday, February 27, 2024

Dreambot Banking Trojan Delivered via Resume-Themed Email

Dreambot banking Trojan which is a variant of Ursnif spreading via resume themed email, it is one of the most active banking trojans.Its activity on infected computers is very hard to detect at the network level and it communicates over Tor and Peer-to-peer.

It used to specifically target for financial organizations such as corporate and bank sectors to steal the sensitive banking information from organization employees.

Also New Futures has been embedded with it including anti-sandbox Technique to avoid Detection .It targets victim’s by sending personalized emails with the following message text

Hello,

Here is my resume.
Please consider it as soon as possible.
Happy New Year.

Greg Pettegrew

Email: [email protected]

The Email consist of zip file Greg resume.zip and the extracted file is CV_pettegrew.jse which then downloads the Dreambot executable. that has been encoded with base64.

A .jse file extension used  for Script written in JScript, a programming language used for Windows and Microsoft Internet Explorer scripting; contains source code in a format similar to JavaScript, but the JScript specification is maintained by Microsoft.

Communication over C&C – Dreambot

Once user click and the file it used to send request to C&C Server  over onion network using port 80 then download an orignial payload to infect the windows based machine.

31.11.33.145 port 80 – www.i-tony.net
31.11.33.145 port 80 – www.i-tony.net
164.132.120.220 port 80 – 164.132.120.220
198.105.244.228 port 80 – wdwefwefwwfewdefewfwefw.onion
198.105.244.228 port 80 – wdwefwefwwfewdefewfwefw.onion

According to malwaretrafficanalysis report.

Dream bot communicates over Tor network, due to the nature of onion sites taking down the C&C servers is difficult.The primary goal of the trojan is to steal the financial details from your computer. It has a persistent nature and sits in the windows registry.

SHA256 hash: 12bf51f905667a25261b55b7dd9e9812e09673617d79d267af749073d43b2cc3 (Greg resume.zip)
SHA256 hash: 67fdeb838110c94957d475841c4ff3827db59e4c6ef628dc57e9199aeb543512 (CV-Pettegrew.jse)
SHA256 hash: 1fa7952beab93e9522021fa7ed2231605a573f3fa3f68f1d5e609673a4321138 (devmprov.exe)

Network Defence

Recommended blocking the following domains.

hxxp://www.i-tony.net/images/rn.php
hxxp://164.132.120.220/view/ra64.css
wdwefwefwwfewdefewfwefw.onion

Common Defence’s to stay safe

  • Don’t open the attachments that you are not expecting.
  • Patch or Update your software.
  • Use a reputable security suite.
  • Download applications from Reputed sites.
  • Stay strict with CIA Cycle.
Website

Latest articles

Zyxel Firewall Flaw Let Attackers Execute Remote Code

Four new vulnerabilities have been discovered in some of the Zyxel Firewall and access...

Hackers Abuse Telegram API To Exfiltrate User Information

Attackers have been using keywords like "remittance" and "receipts" to spread phishing scripts using...

ThreatHunter.ai Stops Hundreds of Attacks in 48 Hours: Fighting Ransomware and Nation-State Cyber Threats

The current large surge in cyber threats has left many organizations grappling for security...

WordPress Plugin Flaw Exposes 200,000+ Websites for Hacking

A critical security flaw has been identified in the Ultimate Member plugin for WordPress,...

Hackers Actively Hijacking ConnectWise ScreenConnect server

ConnectWise, a prominent software company, issued an urgent security bulletin on February 19, 2024,...

Heavily Obfuscated PIKABOT Evades EDR Protection

PIKABOT is a polymorphic malware that constantly modifies its code, making it hard to...

Anonymous Sudan Promoting New DDoS Botnet: Beware

It has come to light that a group known as Anonymous Sudan is actively...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles