{
  "family": "dreambot",
  "sample_count": 17,
  "category": "ransomware",
  "description": "Trojan:Win32/Dreambot is a highly sophisticated, deeply evasive banking trojan that evolved from the leaked source code of the infamous Ursnif (Gozi/ISFB) malware. Dreambot is distinct from its predecessor primarily through its heavy reliance on the Tor network for resilient, anonymized Command and Control (C2) communication, making it a tier-one threat for financial institutions.<br><br><b>Understanding Dreambot</b><br>To a victim, Dreambot is entirely invisible until fraudulent transactions occur. For a threat intelligence analyst, Dreambot represents the professionalization of cybercrime. It is operated by organized groups who utilize it for targeted banking fraud, credential theft, and increasingly, as an initial access vector to deploy high-value ransomware (like Ryuk or Egregor). It features advanced Man-in-the-Browser (MitB) capabilities and extensive anti-analysis checks.<br><br><b>Execution, Tor C2, and Web Injects</b><br>Dreambot is typically delivered via highly crafted spearphishing emails containing weaponized Office documents (macros) or malicious links (`T1566.001`). Upon execution, it performs rigorous anti-sandbox and anti-VM checks before unpacking its payload (`T1497`). It establishes persistence via the Registry and injects its core DLLs into `explorer.exe` or browser processes (`T1055.001`). Its defining characteristic is the deployment of a hidden Tor client. It communicates with its C2 infrastructure exclusively over Tor hidden services (`.onion` addresses), rendering traditional IP/Domain blocking useless (`T1090.003`). Dreambot intercepts browser API calls (`T1185`) to inject malicious HTML directly into targeted banking portals (`T1111`), stealing credentials and manipulating transactions in real-time.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial fraud and potential ransomware deployment. EDR platforms must alert on the injection of unsigned DLLs and the execution of Tor-related processes (often heavily disguised) originating from user directories. Network logs will reveal anomalous, sustained connections to Tor entry nodes. Memory analysis is critical to extract the decrypted Tor configuration and the web inject payload.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.001",
    "T1090.003",
    "T1111",
    "T1185",
    "T1497"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy (Tor)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1185",
      "name": "Man-in-the-Browser",
      "tactic": "Collection"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497",
      "name": "Virtualization/Sandbox Evasion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; the attacker has active, real-time control over the user's web browser sessions and Tor tunnels.",
    "Initiate a mandatory password reset for all financial and corporate accounts accessed from the infected machine, utilizing a known-clean device.",
    "Capture a forensic memory image (RAM dump) to extract the decrypted Tor C2 addresses and the specific web inject configurations.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force the revocation of any session tokens or cookies stored on the machine."
  ],
  "what_to_avoid": [
    "Do not rely on standard DNS or IP blocklists to contain Dreambot; its Tor-based C2 infrastructure easily bypasses perimeter network defenses.",
    "Avoid allowing the user to continue working while 'monitoring' the threat; Dreambot frequently acts as a precursor to enterprise-wide ransomware deployment."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}