Distribution of DanaBot Malware via Word Files Detected by AhnLab EDR

There are two types of malicious documents that are distributed via email recently: those exploiting equation editor and those including external link URLs. This post will describe the infection flow of the DanaBot malware that is distributed through documents containing external links, the latter method, as well as the evidence and detection process with the AhnLab EDR product’s diagram.  Figure 1 shows the content of a spam email with a Word document attached that contains an external link. As you …

ahnlab danabot distributed distribution documents editor edr email equation equation editor exploiting external files flow infection link links malicious malware malware analysis types urls word