During the past few years, we have witnessed a concerning increase in the frequency of phishing and malware attacks. This year too, we saw several banking Trojans returning with robust hacking features. After various damaging banking Trojans, such as Exobot, MysteryBot, Anubis, and Kronos, now, DanaBot malware appears to try to hack your money.
Phishing Campaign Delivering DanaBot Malware Attacks Aussies
A couple of weeks ago, DanaBot appeared in a robust phishing scam specifically targeting Australians. The spam emails appeared to be forwarded from MYOB – a software company in Australia providing business software to various SMBs.
These emails appeared as invoices from MYOB. Upon clicking the emails, users reach a compromised FTP server bearing the DanaBot malware. The technique arose as a robust phishing scam targeting various businesses, particularly in Australia. Researchers from Trustwave identified DanaBot’s association with this phishing campaign. Explaining about the phishing attack, the researchers state in their blog,
DanaBot Malware was first discovered by Proofpoint in May 2018 after noticing the massive phishing campaign targeting Australians. Later on, Trustwave researchers also posted a detailed analysis of the malware after observing the scam. It appears the phishing campaign is growing in the region over a period of time alongside improvisations in the DanaBot Trojan.
Quick Overview Of DanaBot Banking Trojan
For the recent campaign, DanaBot Trojan, written in Delphi, comprised of three main components: The DanaBot Dropper (TempVBH56.exe), the DanaBot Downloader (091A4F71.dll), and the DanaBot Master DLL (6AD4B832.dll). Regarding how these work after the user gets to the compromised FTP server, Trustwave states,
After that, the dropper file “TempVBH56.exe” executes the downloader, which then executes the DanaBot Master in a cascade. The DanaBot Master then further downloads an encrypted file that contains various modules and configurations files and decrypts it.
“The filenames of the DLLs extracted from the encrypted file reveal the true intention of the attackers. In essence, these DLLs enable the attacker to create and control a remote host via VNC, steal private and sensitive information and use covert channels via Tor.”
Besides giving the access of the infected device to the hacker, DanaBot can also send screenshots of the machine to the C&C.
At the moment, the malware seems restricted to Australia. However, nobody knows when this malware begins targeting users in others parts of the world. Users, particularly the SMBs, need to remain wary of these phishing scams by avoiding clicking on any emails unless they are sure of the senders.
Let us know what you think in the comments section.