Pierluigi Paganini September 22, 2018

Security experts at ESET have recently observed a surge in activity of DanaBot banking Trojan that is now targeting Poland, Italy, Germany, Austria, and as of September 2018, Ukraine.

Security experts at ESET have recently observed a surge in activity of DanaBot banking Trojan that was first spotted earlier this year.

DanaBot is a multi-stage modular banking Trojan written in Delphi, the malware allows operators to add new functionalities by adding new plug-ins.

Below some plug-ins that have been used in previous attacks against Australian banks in May 2018:

• VNC plug-in – establishes a connection to a victim’s computer and remotely controls it
• Sniffer plug-in – injects malicious scripts into a victim’s browser, usually while visiting internet banking sites
• Stealer plug-in – harvests passwords from a wide variety of applications (browsers, FTP clients, VPN clients, chat and email programs, poker programs etc.)
• TOR plug-in – installs a TOR proxy and enables access to .onion web sites

When it was analyzed by Proofpoint, its experts speculated the threat has been under active development.

The banking Trojan initially targeted Australia and Poland users, then it has expanded in other countries, including Italy, Germany, Austria, and as of September 2018, Ukraine.

The campaign targeting Poland is still ongoing and is the largest one, attackers used spam messages to compromise victims leveraging the Brishloader technique, a combination of PowerShell and VBS scripts.

Earlier September, a series of smaller campaigns targeted banks in Italy, Germany, and Austria.

“Further to this development, on September 8, 2018, ESET discovered a new DanaBot campaign targeting Ukrainian users.” reads the analysis published by ESET.

“Figure 2 shows a spike in the DanaBot detection rate at the turn of August and again in September 2018, as seen in our telemetry data.”

Expert noticed the attackers have introduced several changes to the DanaBot plug-ins since the previously reported campaigns, for example, the Stealer plug-in was also compiled for 64-bit version since August 25, 2018.

Since the beginning of September 2018, the author of DanaBot also implemented the RDP plug-in based on the open-source project RDPWrap that provides Remote Desktop Protocol connections to Windows machines that normally do not support it.

The malware also implemented the RDP plug-in because the protocol is less likely to be blocked by firewalls, experts also highlighted that the RDPWrap allows several users to use the same machine concurrently. This aspect is very important because the attackers can perform reconnaissance operations while the victim is still using the machine.

DanaBot is a very active threat, its operators continue to improve it while targeting  European countries.

“The new features introduced in these latest campaigns indicate the attackers behind DanaBot continue to make use of the malware’s modular architecture to increase their reach and success rate.” concludes ESET.

Further details, including IoCs are reported in the analysis published by ESET.

Pierluigi Paganini

(Security Affairs – DanaBot, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]