DanBot
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
DanBot can use HTTP in C2 communication.(Citation: SecureWorks August 2019) |
| .004 | Application Layer Protocol: DNS |
DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications.(Citation: SecureWorks August 2019) |
||
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
DanBot has the ability to execute arbitrary commands via `cmd.exe`.(Citation: SecureWorks August 2019)(Citation: ClearSky Siamesekitten August 2021) |
| .005 | Command and Scripting Interpreter: Visual Basic |
DanBot can use a VBA macro embedded in an Excel file to drop the payload.(Citation: SecureWorks August 2019) |
||
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
DanBot can delete its configuration file after installation.(Citation: ClearSky Siamesekitten August 2021) |
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.(Citation: ClearSky Siamesekitten August 2021) |
| Enterprise | T1027 | .013 | Obfuscated Files or Information: Encrypted/Encoded File |
DanBot can Base64 encode its payload.(Citation: SecureWorks August 2019) |
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
DanBot has been distributed within a malicious Excel attachment via spearphishing emails.(Citation: SecureWorks August 2019) |
| Enterprise | T1021 | .005 | Remote Services: VNC |
DanBot can use VNC for remote access to targeted systems.(Citation: ClearSky Siamesekitten August 2021) |
| Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
DanBot can use a scheduled task for installation.(Citation: SecureWorks August 2019) |
| Enterprise | T1204 | .002 | User Execution: Malicious File |
DanBot has relied on victims' opening a malicious file for initial execution.(Citation: SecureWorks August 2019)(Citation: ClearSky Siamesekitten August 2021) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.