Danabot Banking Trojan Targets Banks in the United States

Over the past few months, banking Trojans have disseminated their global impact by almost 50 %.  The appropriate security measures adopted by banks to strengthen their processes have proven futile with the never-before seen tactics evolved by the developers to facilitate the theft of online funds.
Banking Trojans continue to be a popular tool among cyber maniacs for stealing user’s banking details and draining bank accounts.
The discovery of Danabot, another Banking Trojan in a row is an evidence to establish the fact. With the widely- reported initial campaigns in Australia, this banking Trojan later expanded its reach to European countries particularly Austria, Poland, Italy, Germany, Ukraine, its latest target being United States.

 What is DanaBot?

DanaBot is a modular Banking Trojan, first discovered in malicious email campaigns targeting Australian population in May 2018. This malware is programmed in Delphi, an Integrated Development Environment (IDE) for rapid application development of Desktops, web, Mobile etc.
The multi-stage and multi-component architecture of DanaBot gives it an edge over other Banking Trojans.
As other banking Trojans, DanaBot attempts to steal account credentials and other banking information of users from online banking sites. This functionality is implemented by a variety of methods like:

• Logging Keystrokes made on the computer
• Stealthily taking screenshots of active screens
• Stealing data from banking forms

The collected information is shared with threat actors via C&C server (Command and Control server).

 DanaBot Multi- Stage Behavior

The multistage infection chain and modular architecture of DanaBot comprises of several components that include:

• VNC (Virtual Network Computing) — connects and hijacks the infected system.
• Sniffer — injects malicious scripts into the browser when user visits online banking websites
• Stealer– Collect banking credentials and other information from a variety of applications like browsers, chats, emails, VPN clients etc.
• TOR — uses a Tor proxy server to access .onion websites (anonymous hidden services
• RDP — used to access Remote Desktop Protocol-based (RDP) machines;

All these plug-ins are used to create a covert communication channel between the attacker and a victim, and hence embezzle user of their hard earned money.

Threat Behavior of the North American Campaign
Read Full Article:- Click here