Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.



08:05 AM
Jeffrey Burt
Jeffrey Burt
Jeffrey Burt

DanaBot Banking Trojan Is Now Finding Its Way to the US

The DanaBot Trojan first targeting organizations in Australia earlier this year has expanded into Europe and now is aiming at US, according to Proofpoint.

A banking Trojan that was discovered earlier this year and targeted organizations in Australia has made its way across Europe and now is being used in campaigns in the US, according to researchers with cybersecurity vendor Proofpoint.

In September, researchers found a campaign based on the DanaBot Trojan that was using hundreds of thousands of email messages that were aimed at recipients in the US.

It appears that this campaign was being run by the same threat actor who has used the Panda banking Trojan in daily campaigns in the US. Then, for at least a day, the cyberciminal switched to DanaBot.

The appearance of the DanaBot Trojan illustrates how quickly a formidable piece of malware can be adopted and enhanced by other bad actors and expand its reach, according to Chris Dawson, threat intelligence lead at Proofpoint. It also points to the continued and growing popularity of banking Trojans among attackers as a way of gaining quick access to a lot of money. (See Kronos Returns as Banking Trojan Attacks Ramp Up.)

"The actor we first associated with DanaBot's distribution in Australia is noted for purchasing banking Trojans from other developers and operators, suggesting that DanaBot would be available for sale more widely to other threat actors soon," Dawson told Security Now in an email. "Moreover, DanaBot's anti-analysis capabilities, updated stealer, and remote control modules likely caught other threat actors' attentions, sparking the global distribution that we've observed."

Proofpoint analysts first discovered DanaBot in May and tied it to a single actor who was eyeing victims in Australia.

Quickly campaigns using DanaBot were discovered by ESET researchers in Germany, Austria, Italy and Poland, while Proofpoint detected additional campaigns in Australia. On September 26, a campaign in the US was seen using an eFax in email messages as the lure for victims. It contained a URL that led to the downloading of a document that contained malicious macros that, if enabled by the user, put the embedded Hancitor malware into play. That malware would contact the command-and-control server and then download two versions of Pony Stealer and the DanaBot malware.

DanaBot is written in Delphi and includes the loader, main component that downloads, configures and loads modules, and the modules themselves, which contain various malware capabilities.

"DanaBot includes a significant amount of junk code including extra instructions, conditional statements, and loops," the Proofpoint researchers note in a blog post. "When combined with the use of Delphi, these features dramatically impair reverse engineering. In addition, DanaBot uses Windows API function hashing and encrypted strings to prevent analysts and automated tools from easily determining the code’s purpose."

They wrote that they didn't have great visibility into DanaBot's C&C infrastructure, but noted that the main component of the Trojan contains a list of ten, hard-coded C& IP addresses used for malware communications. Those lists changed about every hour when the main component was downloaded, which told the analysts that Danabot "follows in a long line of malware from one particular group. This family began with ransomware, to which stealer functionality was added in Reveton. The evolution continued with CryptXXX ransomware and now with a banking Trojan with Stealer and remote access functionality added in Danabot."

The popularity of DanaBot is not a surprise, given the rising interest among threat actors in banking Trojans in general. Proofpoint's latest quarterly report found that the banking Trojan was the most popular type of malware the second quarter this year, accounting for 42% of malware detected. In their own second-quarter report, Kaspersky Lab researchers found similar trends, with the rise of mobile banking Trojans fueled in part by modifications aimed at helping the malware evade security tools. In all, Kaspersky researchers found 61,045 installation packages for mobile banking, three times the number seen in the first quarter. (See Banking Trojans on the Rise in Q2, Kaspersky Report Finds.)

"Cybercriminals follow the money and banking trojans allow threat actors to literally remove funds from a target's bank account, providing instant financial gain," Dawson wrote. "Contextually, our data sees significant targeting of commercial enterprise bank accounts rather than consumer checking accounts due to the significant difference in funds. Threat actors typically leverage banking Trojans to access large payroll accounts, accounts used to pay for inventory, and other accounts that have significant amounts of corporate funds available to steal."

The fact that such Trojans usually run on the client side with man-in-the-browser kind of attacks makes it difficult for banks to address them beyond implementing multi-factor authentication, he said.

"Instead, organizations and individuals are considered the front line of defense against banking Trojans," Dawson added. "As with other types of malware, multilayered defenses at the email gateway, the network gateway, and the endpoint, along with strong user education programs, are all critical for organizations looking to prevent infections with banking Trojans."

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-12-03
Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_ReceiveUnreliableSegment() when configured to support plain-text messages, leading to a Heap-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code ...
PUBLISHED: 2020-12-03
Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted DL...
PUBLISHED: 2020-12-03
An exploitable denial-of-service vulnerability exists in the IPv4 functionality of Allen-Bradley MicroLogix 1100 Programmable Logic Controller Systems Series B FRN 16.000, Series B FRN 15.002, Series B FRN 15.000, Series B FRN 14.000, Series B FRN 13.000, Series B FRN 12.000, Series B FRN 11.000 and...
PUBLISHED: 2020-12-03
Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.
PUBLISHED: 2020-12-03
Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier) allows remote attackers to inject arbitrary script via unspecified vectors.