Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.



08:05 AM
Jeffrey Burt
Jeffrey Burt
Jeffrey Burt

DanaBot Banking Trojan Is Now Finding Its Way to the US

The DanaBot Trojan first targeting organizations in Australia earlier this year has expanded into Europe and now is aiming at US, according to Proofpoint.

A banking Trojan that was discovered earlier this year and targeted organizations in Australia has made its way across Europe and now is being used in campaigns in the US, according to researchers with cybersecurity vendor Proofpoint.

In September, researchers found a campaign based on the DanaBot Trojan that was using hundreds of thousands of email messages that were aimed at recipients in the US.

It appears that this campaign was being run by the same threat actor who has used the Panda banking Trojan in daily campaigns in the US. Then, for at least a day, the cyberciminal switched to DanaBot.

The appearance of the DanaBot Trojan illustrates how quickly a formidable piece of malware can be adopted and enhanced by other bad actors and expand its reach, according to Chris Dawson, threat intelligence lead at Proofpoint. It also points to the continued and growing popularity of banking Trojans among attackers as a way of gaining quick access to a lot of money. (See Kronos Returns as Banking Trojan Attacks Ramp Up.)

Corrupt email that is part of the DanaBot campaign\r\n(Source: Proofpoint)\r\n
Corrupt email that is part of the DanaBot campaign
\r\n(Source: Proofpoint)\r\n

"The actor we first associated with DanaBot's distribution in Australia is noted for purchasing banking Trojans from other developers and operators, suggesting that DanaBot would be available for sale more widely to other threat actors soon," Dawson told Security Now in an email. "Moreover, DanaBot's anti-analysis capabilities, updated stealer, and remote control modules likely caught other threat actors' attentions, sparking the global distribution that we've observed."

Proofpoint analysts first discovered DanaBot in May and tied it to a single actor who was eyeing victims in Australia.

Quickly campaigns using DanaBot were discovered by ESET researchers in Germany, Austria, Italy and Poland, while Proofpoint detected additional campaigns in Australia. On September 26, a campaign in the US was seen using an eFax in email messages as the lure for victims. It contained a URL that led to the downloading of a document that contained malicious macros that, if enabled by the user, put the embedded Hancitor malware into play. That malware would contact the command-and-control server and then download two versions of Pony Stealer and the DanaBot malware.

DanaBot is written in Delphi and includes the loader, main component that downloads, configures and loads modules, and the modules themselves, which contain various malware capabilities.

"DanaBot includes a significant amount of junk code including extra instructions, conditional statements, and loops," the Proofpoint researchers note in a blog post. "When combined with the use of Delphi, these features dramatically impair reverse engineering. In addition, DanaBot uses Windows API function hashing and encrypted strings to prevent analysts and automated tools from easily determining the code’s purpose."

They wrote that they didn't have great visibility into DanaBot's C&C infrastructure, but noted that the main component of the Trojan contains a list of ten, hard-coded C& IP addresses used for malware communications. Those lists changed about every hour when the main component was downloaded, which told the analysts that Danabot "follows in a long line of malware from one particular group. This family began with ransomware, to which stealer functionality was added in Reveton. The evolution continued with CryptXXX ransomware and now with a banking Trojan with Stealer and remote access functionality added in Danabot."

The popularity of DanaBot is not a surprise, given the rising interest among threat actors in banking Trojans in general. Proofpoint's latest quarterly report found that the banking Trojan was the most popular type of malware the second quarter this year, accounting for 42% of malware detected. In their own second-quarter report, Kaspersky Lab researchers found similar trends, with the rise of mobile banking Trojans fueled in part by modifications aimed at helping the malware evade security tools. In all, Kaspersky researchers found 61,045 installation packages for mobile banking, three times the number seen in the first quarter. (See Banking Trojans on the Rise in Q2, Kaspersky Report Finds.)

"Cybercriminals follow the money and banking trojans allow threat actors to literally remove funds from a target's bank account, providing instant financial gain," Dawson wrote. "Contextually, our data sees significant targeting of commercial enterprise bank accounts rather than consumer checking accounts due to the significant difference in funds. Threat actors typically leverage banking Trojans to access large payroll accounts, accounts used to pay for inventory, and other accounts that have significant amounts of corporate funds available to steal."

The fact that such Trojans usually run on the client side with man-in-the-browser kind of attacks makes it difficult for banks to address them beyond implementing multi-factor authentication, he said.

"Instead, organizations and individuals are considered the front line of defense against banking Trojans," Dawson added. "As with other types of malware, multilayered defenses at the email gateway, the network gateway, and the endpoint, along with strong user education programs, are all critical for organizations looking to prevent infections with banking Trojans."

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Sure you have fire, but he has an i7!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-05
SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.
PUBLISHED: 2021-03-04
On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, portions of the drive containing executable code were not encrypted thus leaving it open to potential cryptographic information disclosure.
PUBLISHED: 2021-03-04
Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission.
PUBLISHED: 2021-03-04
Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format.
PUBLISHED: 2021-03-04
A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code execution.