DanDrop
Description
(SecureWorks) The threat actors use this malicious macro to extract the DanBot payload from the weaponized document and then Base64-decode and install the malware using a scheduled task. The basic form and function of the macro have remained constant across analyzed samples, but the threat actors have made incremental improvements to obfuscate the macro and refactor some of the functionality.
Names
| Name |
|---|
| DanDrop |
Category
Malware
Type
- Dropper
Information
Other Information
Uuid
580fa928-850c-4a8e-9b58-406a68f57e13
Last Card Change
2020-04-20