{
  "family": "dreambot",
  "sample_count": 17,
  "category": "banking_trojan",
  "description": "DreamBot (also recognized as a prominent branch of the Ursnif/ISFB banking trojan family, tracked under designations including Trojan:Win32/DreamBot, Trojan:Win32/Ursnif.DreamBot, and Win32/DreamBot) is a sophisticated modular banking trojan and info-stealer active since 2014. Distributed via malspam campaigns containing macro-enabled Microsoft Word/Excel attachments, DreamBot deploys complex anti-analysis techniques including Tor-based C2 communication, Domain Generation Algorithms (DGA), and API hashing. DreamBot injects code into explorer.exe and web browsers, conducting Man-in-the-Browser (MitB) attacks, capturing keystrokes, stealing digital certificates, and intercepting online banking credentials and cryptocurrency wallet data.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/DreamBot",
    "Trojan:Win32/Ursnif.DreamBot",
    "Win32/DreamBot",
    "DreamBot Banking Trojan",
    "Ursnif-DreamBot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/DreamBot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DreamBot is an Ursnif/ISFB-derived modular banking trojan that steals credentials via Tor-based C2 and Man-in-the-Browser attacks."
      }
    },
    {
      "@type": "Question",
      "name": "How does DreamBot conceal its command-and-control communication?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It communicates through Tor onion routing nodes and backup Domain Generation Algorithms (DGA) to evade network blocking."
      }
    },
    {
      "@type": "Question",
      "name": "What browser mechanisms does DreamBot exploit to steal data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects into web browsers (Chrome, Firefox, Edge) to intercept form data, session cookies, and banking credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How is DreamBot delivered to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious spam campaigns delivering macro-laced Office documents and weaponized zip archives."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures protect against DreamBot infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block inbound emails containing macro-enabled documents, monitor for unauthorized Tor traffic, and enforce hardware MFA."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1056.001",
    "T1055.001",
    "T1568.002",
    "T1090.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Spam Emails with Macro Documents",
    "Secondary Exploit Kit Loaders",
    "Deceptive Torrent Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Man-in-the-Browser (MitB) Form Grabbing",
    "Tor Hidden Service C2 Communication",
    "Domain Generation Algorithm (DGA) Failover",
    "Process Injection into explorer.exe & Browsers",
    "Keystroke Logging & Digital Certificate Theft"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound TLS connections to Tor directory authorities and guard nodes on port 443/9001",
      "Periodic DNS queries generated by DGA routines resolving dynamic domains"
    ],
    "evasion_techniques": [
      "API hashing to mask sensitive DLL function imports",
      "Anti-VM and anti-debugger routines checking CPU timing and registry hypervisor keys"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9c0192a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9",
      "0d1292a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8ea"
    ],
    "registry_keys": [
      "HKCU\\Software\\AppDataLow\\Software\\Microsoft\\DreamBot",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DreamBotClient"
    ],
    "file_paths": [
      "%AppData%\\DreamBot\\client.exe",
      "%LocalAppData%\\Temp\\inject.dll"
    ]
  },
  "defensive_measures": [
    "Block outbound connections to known Tor guard relays and directory authorities using threat intelligence IP feeds",
    "Deploy endpoint security software capable of detecting in-memory process injection and API hooking",
    "Utilize hardware-backed multi-factor authentication (security keys) resistant to web inject interception"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/DreamBot",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DreamBot"
    },
    {
      "name": "Trend Micro Security Research - Analyzing DreamBot / Ursnif Banking Variants",
      "url": "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats"
    }
  ],
  "lineage": {
    "derived_from": [
      "Trojan:Win32/Ursnif",
      "Trojan:Win32/ISFB"
    ],
    "variants": [
      "Trojan:Win32/DreamBot.A",
      "Trojan:Win32/DreamBot.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "credential_access",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud & Banking Credential Theft",
  "sample_hashes": []
}