As introduced by the US Division of Justice \u2013 the FBI and US DoD\u2019s Protection Prison Investigative Service (DCIS) have managed to disrupt the infrastructure of the infamous infostealer, Danabot. ESET is likely one of the many cybersecurity corporations to take part on this long-term endeavor, changing into concerned again in 2018. Our contribution included offering technical analyses of the malware and its backend infrastructure, in addition to figuring out Danabot\u2019s C&C servers. The joint takedown effort additionally led to the identification of people liable for Danabot improvement, gross sales, administration, and extra. ESET took half within the effort alongside with Amazon, CrowdStrike, Flashpoint, Google, Intel471, PayPal, Proofpoint, Staff Cymru, Zscaler, Germany\u2019s Bundeskriminalamt, the Netherlands’ Nationwide Police, and the Australian Federal Police.<\/p>\n

These regulation enforcement operations had been performed below Operation Endgame<\/a> \u2013 an ongoing international initiative aimed toward figuring out, dismantling, and prosecuting cybercriminal networks. Coordinated by Europol and Eurojust<\/a>, the operation efficiently took down crucial infrastructure used to deploy ransomware by means of malicious software program.<\/p>\n

Since Danabot has largely been disrupted, we’ll use this chance to share our insights into the workings of this malware-as-a-service (MaaS) operation, masking the options used within the newest variations of the malware, the authors\u2019 enterprise mannequin, and an outline of the toolset provided to associates. Aside from exfiltrating delicate information, we now have noticed that Danabot can also be used to ship additional malware \u2013 together with ransomware \u2013 to an already compromised system.<\/p>\n

\n
Key factors of the blogpost:<\/strong><\/p>\n
\n
ESET Analysis has been monitoring Danabot\u2019s exercise since 2018 as a part of a world effort that resulted in a serious disruption of the malware\u2019s infrastructure.<\/li>\n
Whereas primarily developed as an infostealer and banking trojan, Danabot additionally has been used to distribute extra malware, together with ransomware.<\/li>\n
Danabot\u2019s authors promote their toolset by means of underground boards and supply varied rental choices to potential associates.<\/li>\n
The everyday toolset offered by Danabot\u2019s authors to their associates contains an administration panel software, a backconnect software for real-time management of bots, and a proxy server software that relays the communication between the bots and the precise C&C server.<\/li>\n
Associates can select from varied choices to generate new Danabot builds, and it\u2019s their accountability to distribute these builds by means of their very own campaigns.<\/li>\n<\/ul>\n<\/blockquote>\n
Background<\/h2>\n
Danabot, which belongs to a gaggle of infostealer and\/or banking malware households coded within the Delphi programming language, gained prominence in 2018 by being utilized in a spam marketing campaign<\/a> focusing on Australian customers. Since then, Danabot has expanded<\/a> to different markets by means of varied campaigns, undergone a number of main updates<\/a> of its internals and backend infrastructure, and skilled each peaks and downturns in recognition amongst cybercriminals.<\/p>\n
All through our monitoring since 2018, ESET has tracked and analyzed a considerable variety of distinct samples and recognized greater than 1,000 distinctive C&C servers. Throughout that interval, ESET analyzed varied Danabot campaigns all around the world, with Poland traditionally being some of the focused nations, as seen in Determine 1.<\/p>\n
$\"Figure$
Determine 1. Worldwide Danabot detections as seen in ESET telemetry since 2018<\/em><\/figcaption><\/figure>\nAlong with typical cybercrime, Danabot has additionally been utilized in much less typical actions similar to using compromised machines for launching DDoS assaults. For instance, a DDoS assault towards Ukraine\u2019s Ministry of Protection was noticed by Zscaler<\/a> quickly after the Russian invasion of Ukraine. A really related DDoS module to the one utilized in that assault was additionally utilized by a Danabot operator to focus on a Russian website devoted to Arduino<\/a> improvement. These actions had been in all probability motivated by the affiliate\u2019s personal ambitions and political motivations.<\/p>\n
Danabot group introduction<\/h2>\n
The authors of Danabot function as a single group, providing their software for hire to potential associates, who subsequently make use of it for their very own malicious functions by establishing and managing their very own botnets. The authors have even arrange a assist web page on the Tor community with detailed details about the capabilities of their software, as depicted in Determine 2.<\/p>\n
$\"Figure$
Determine 2. Danabot\u2019s options as promoted on its assist website<\/em><\/figcaption><\/figure>\n
To accumulate new prospects, Danabot is ceaselessly promoted in underground boards by the consumer JimmBee, who acts as one of many predominant builders and directors of the Danabot malware and its toolset. One other noteworthy particular person from the Danabot group is a consumer recognized in underground boards as Onix, who coadministers the Danabot infrastructure and can also be liable for gross sales operations.<\/p>\n
Function overview<\/h2>\n
Danabot\u2019s authors have developed an enormous number of options to help prospects with their malevolent goals. Probably the most outstanding options provided by Danabot embody:<\/p>\n
\n
the power to steal varied information from browsers, mail purchasers, FTP purchasers, and different common software program,<\/li>\n
keylogging and display recording,<\/li>\n
real-time distant management of the victims\u2019 techniques,<\/li>\n
a FileGrabber command, generally used for stealing cryptocurrency wallets,<\/li>\n
assist for Zeus-like<\/a> webinjects<\/a> and type grabbing, and<\/li>\n
arbitrary payload add and execution.<\/li>\n<\/ul>\n
Apart from using its stealing capabilities, we now have noticed a wide range of payloads being distributed by means of Danabot through the years, similar to:<\/p>\n
\n
SystemBC,<\/li>\n
Rescoms,<\/li>\n
Ursnif,<\/li>\n
Smokeloader,<\/li>\n
Zloader,<\/li>\n
Lumma Stealer,<\/li>\n
RecordBreaker,<\/li>\n
Latrodectus, and<\/li>\n
NetSupportManager distant administration software.<\/li>\n<\/ul>\n
Moreover, we now have encountered cases of Danabot getting used to obtain ransomware onto already compromised techniques. We are able to identify LockBit, Buran, Disaster, and a NonRansomware variant<\/a> being pushed on a number of events.<\/p>\n
Danabot\u2019s means to obtain and execute arbitrary payloads will not be the one characteristic used to distribute extra malware. Danabot was additionally noticed getting used as a software at hand off management of the botnet to a ransomware operator, as reported by Microsoft Menace Intelligence<\/a> in late 2023.<\/p>\n
Distribution strategies<\/h2>\n
All through its existence, in line with our monitoring, Danabot has been a software of selection for a lot of cybercriminals and every of them has used totally different technique of distribution. Danabot\u2019s builders even partnered with the authors of a number of malware cryptors and loaders, and provided particular pricing for a distribution bundle to their prospects, serving to them with the method. Matanbuchus<\/a> is an instance of such a promoted loader.<\/p>\n
Over time, we now have seen all kinds of distribution strategies being utilized by Danabot associates, together with:<\/p>\n
\n
quite a few variants of e mail spam campaigns,<\/li>\n
different malware similar to Smokeloader, DarkGate, and Matanbuchus, and<\/li>\n
misuse of Google Adverts.<\/li>\n<\/ul>\n
Lately, out of all distribution mechanisms we noticed, the misuse of Google Adverts to show seemingly related, however really malicious, web sites among the many sponsored hyperlinks in Google search outcomes stands out as some of the outstanding strategies to lure victims into downloading Danabot. The preferred ploy is packing the malware with professional software program and providing such a package deal by means of bogus software program websites (Determine 3) or web sites falsely promising customers to assist them discover unclaimed funds (Determine 4).<\/p>\n
$\"Figure$
Determine 3. Pretend Superior IP Scanner web site resulting in Danabot compromise<\/em><\/figcaption><\/figure>\n
$\"Figure$
Determine 4. Pretend unclaimed cash search website<\/em><\/figcaption><\/figure>\n
The newest addition to those social engineering methods: misleading web sites providing options for fabricated laptop points, whose solely goal is to lure the sufferer into execution of a malicious command secretly inserted into the consumer\u2019s clipboard. An instance of such an internet site resulting in downloading of Danabot in Determine 5.<\/p>\n
$\"Figure$
Determine 5. Web site luring the sufferer into execution of malicious command saved within the consumer\u2019s clipboard<\/em><\/figcaption><\/figure>\n
Infrastructure<\/h2>\n
Overview<\/h3>\n
Initially, Danabot\u2019s authors relied on a single centralized server to handle all bots\u2019 connections and all associates\u2019 information, similar to command configurations and information collected from their victims. This centralized method definitely had a detrimental influence on that server\u2019s efficiency and was extra susceptible to potential disruptions. That is in all probability one of many the reason why we noticed a shift within the enterprise and infrastructure fashions in newer variations. Along with renting locations on their very own infrastructure, Danabot\u2019s authors now supply set up of a personal server, as marketed on their assist website, to be operated by the affiliate (Determine 6).<\/p>\n
$\"Figure$
Determine 6. Fundamental providing on Danabot\u2019s assist website<\/em><\/figcaption><\/figure>\n
The rental choices, as provided by means of an underground discussion board in July 2023, are illustrated in Determine\u00a07.<\/p>\n
$\"Figure$
Determine 7. Value checklist for potential Danabot prospects<\/em><\/figcaption><\/figure>\n
It’s value mentioning that, based mostly on our monitoring, the rental of an account on the shared infrastructure managed by Danabot\u2019s authors appears to be the most well-liked selection for risk actors.<\/p>\n
When associates buy a rental of one of many choices, they’re given instruments and credentials to hook up with the C&C server and handle their very own botnet by means of an administration panel. Within the following sections, we cowl the totally different components of the everyday toolset.<\/p>\n
C&C server software<\/h3>\n
The standalone server software comes within the type of a DLL file and acts because the mind of the botnet. It’s put in on a Home windows server and makes use of a MySQL database for information administration. Bots connect with this server to transmit stolen information and obtain instructions issued by associates. Associates connect with this server through the administration panel software to handle their botnet. This C&C server software is offered for native set up just for associates paying for the upper tier private server possibility. Associates who select to function their botnets on Danabot\u2019s infrastructure as a substitute are given connection particulars to the C&C server already arrange there, and don’t have to host their very own C&C server.<\/p>\n
Administration panel<\/h3>\n
The administration panel, displayed in Determine 8, is within the type of a GUI software, and represents crucial software from the botnet operator\u2019s perspective. It permits the affiliate to hook up with the C&C server and carry out duties similar to:<\/p>\n
\n
handle bots and retrieve statistics of the botnet,<\/li>\n
concern varied instructions and superior configuration for bots,<\/li>\n
conveniently view and export information gathered from victims,<\/li>\n
handle the notification system and arrange alerts on occasions triggered by bots,<\/li>\n
generate new Danabot builds, and<\/li>\n
arrange a series of proxy servers for communication between the bots and the C&C server.<\/li>\n<\/ul>\n
We offer extra particulars and examples of essentially the most fascinating capabilities of the administration panel within the upcoming sections.<\/p>\n
$\"Figure$
Determine 8. Administration panel overview<\/em><\/figcaption><\/figure>\n
Backconnect software<\/h3>\n
One other essential software for administration is the standalone utility that permits botnet operators to remotely connect with and management their on-line bots. Out there actions for distant management, as seen within the software, are illustrated in Determine 9. In all probability essentially the most fascinating options for cybercriminals are the power to see and management the sufferer\u2019s laptop through a distant desktop connection and to carry out reconnaissance of the file system utilizing the built-in file supervisor.<\/p>\n
$\"Figure$
Determine 9. Options of the backconnect utility<\/em><\/figcaption><\/figure>\n
Proxy server software<\/h3>\n
Bots sometimes don’t connect with the principle C&C server immediately, however relatively use a series of proxies to relay the site visitors and conceal the placement of the true backend C&C. To facilitate this technique, Danabot\u2019s authors present a proxy server software, accessible for each Home windows and Linux techniques. Determine 10 exhibits the utilization message from the Linux model of this easy proxy server software. Apart from utilizing proxies, bots will be configured to speak with the server by means of the Tor community in case all proxy chains grow to be unavailable. An elective downloadable Tor module is then used for such communication.<\/p>\n
$\"Figure$
Determine 10. Utilization message from the Linux model of the proxy server software<\/em><\/figcaption><\/figure>\n
Associates additionally ceaselessly make the most of this proxy server software as an middleman between their administration panel and the C&C server to additional improve their anonymity. When the whole lot is put collectively, the everyday infrastructure could look as proven in Determine 11.<\/p>\n
$\"Figure$
Determine 11. Instance of typical Danabot infrastructure<\/em><\/figcaption><\/figure>\n
Internals<\/h2>\n
Communication<\/h3>\n
Danabot employs its personal proprietary C&C communication protocol with its information encrypted utilizing AES-256. Generated AES session keys, distinctive for each message, are then additional encrypted utilizing RSA key pairs, securing the entire communication. It\u2019s value mentioning that there have been a number of updates to the communication protocol and the packet construction over time.<\/p>\n
The present packet information construction of the everyday command, earlier than it’s encrypted, appears to be like as proven in Desk 1 . We wish to level out that many of the fields are solely used through the first request within the communication loop to authenticate the bot, and are left unset within the subsequent instructions.<\/p>\n
Desk 1. Packet construction utilized in Danabot communication<\/em><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Offset<\/strong><\/td>\n Dimension\u00a0(bytes)<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
0x00<\/span><\/td>\n 0x04<\/span><\/td>\n Dimension of the packet.<\/td>\n<\/tr>\n
0x04<\/span><\/td>\n 0x08<\/span><\/td>\n Random worth.<\/td>\n<\/tr>\n
0x0C<\/span><\/td>\n 0x08<\/span><\/td>\n Sum of the 2 values above.<\/td>\n<\/tr>\n
0x14<\/span><\/td>\n 0x04<\/span><\/td>\n Account ID used to distinguish associates within the earlier variations. This discipline comprises a random worth in newer variations.<\/td>\n<\/tr>\n
0x18<\/span><\/td>\n 0x04<\/span><\/td>\n Command.<\/td>\n<\/tr>\n
0x1C<\/span><\/td>\n 0x04<\/span><\/td>\n Subcommand.<\/td>\n<\/tr>\n
0x20<\/span><\/td>\n 0x04<\/span><\/td>\n Danabot model.<\/td>\n<\/tr>\n
0x24<\/span><\/td>\n 0x04<\/span><\/td>\n IsUserAdmin<\/span> flag.<\/td>\n<\/tr>\n
0x28<\/span><\/td>\n 0x04<\/span><\/td>\n Course of integrity stage.<\/td>\n<\/tr>\n
0x2C<\/span><\/td>\n 0x04<\/span><\/td>\n OS structure x86\/x64.<\/td>\n<\/tr>\n
0x30<\/span><\/td>\n 0x04<\/span><\/td>\n Encoded Home windows model.<\/td>\n<\/tr>\n
0x34<\/span><\/td>\n 0x04<\/span><\/td>\n Time zone bias as a DWORD worth.<\/td>\n<\/tr>\n
0x38<\/span><\/td>\n 0x04<\/span><\/td>\n Unknown bytes; set to 0<\/span> within the present variations.<\/td>\n<\/tr>\n
0x3C<\/span><\/td>\n 0x04<\/span><\/td>\n Tor energetic flag.<\/td>\n<\/tr>\n
0x40<\/span><\/td>\n 0x04<\/span><\/td>\n Unknown bytes; set to 0<\/span> within the present variations.<\/td>\n<\/tr>\n
0x44<\/span><\/td>\n 0x18<\/span><\/td>\n Padding null bytes.<\/td>\n<\/tr>\n
0x5C<\/span><\/td>\n 0x21<\/span><\/td>\n Bot ID Delphi string (a string preceded by a size byte).<\/td>\n<\/tr>\n
0x7D<\/span><\/td>\n 0x21<\/span><\/td>\n Construct ID hardcoded Delphi string.<\/td>\n<\/tr>\n
0x9E<\/span><\/td>\n 0x21<\/span><\/td>\n MD5 checksum of concatenated Account ID, Bot ID, and Construct ID strings.<\/td>\n<\/tr>\n
0xBF<\/span><\/td>\n 0x29<\/span><\/td>\n Command dependent string utilized in some instructions complemented by its CRC-32 and a string dimension.<\/td>\n<\/tr>\n
0xE8<\/span><\/td>\n 0xDF<\/span><\/td>\n Padding null bytes.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
The most recent variations of Danabot additionally add, to additional disguise its communication, a random quantity of seemingly junk bytes to the top of the packet construction earlier than it’s encrypted. It\u2019s value mentioning that Danabot authors don’t at all times observe the very best coding practices and the addition of this random variety of bytes was performed by resizing of the unique reminiscence buffer allotted to carry the packet construction as a substitute of clearing or initializing this newly acquired area. This led to unintentionally together with surrounding reminiscence areas of the method into the info packet being despatched from the bot to the server and, extra importantly, vice versa. These appended reminiscence areas captured and decrypted from the server-to-bot communication generally contained fascinating info from the server\u2019s course of reminiscence and gave researchers invaluable perception into Danabot\u2019s infrastructure and its customers. This bug was launched in 2022 and was fastened within the newest variations of Danabot in February 2025.<\/p>\n
Additional particulars in regards to the communication and its encryption had been already coated by varied researchers<\/a>, and we received\u2019t dive into it extra on this blogpost.<\/p>\n
Builds<\/h3>\n
Botnet operators have a number of choices for producing new Danabot builds to distribute to their victims. To the very best of our information, whereas the operator could configure the construct course of and desired output by means of the administration panel software, the construct course of itself is carried out on the Danabot authors\u2019 servers. After producing the chosen construct, the operator receives obtain hyperlinks for the builds and turns into liable for their distribution in a marketing campaign.<\/p>\n
Determine 12 exhibits an instance of a construct configuration window and accessible choices, such because the C&C server checklist to be configured within the last binary file, varied obfuscation strategies, construct bitness, and so on.<\/p>\n
$\"Figure$
Determine 12. Construct choices menu from the Administration panel software<\/em><\/figcaption><\/figure>\n
Danabot presently provides 4 primary payload varieties, described in Desk 2.<\/p>\n
Desk 2. Variants of obtainable builds<\/em><\/p>\n
<\/p>\n\n\n\n\n\n\n\n\n
Payload sort<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Important.dll<\/span><\/td>\n Generates a sole predominant part within the type of a DLL to be distributed and loaded through rundll32.exe<\/span> or regsvr32.exe<\/span>.<\/td>\n<\/tr>\n
Important.exe<\/span><\/td>\n Generates a loader within the type of an EXE that will comprise the abovementioned predominant part DLL or obtain it from one of many configured C&C servers.<\/td>\n<\/tr>\n
Drop.exe<\/span><\/td>\n Generates a dropper with an embedded predominant part DLL to be dropped to disk.<\/td>\n<\/tr>\n
Drop.msi<\/span><\/td>\n Generates an MSI package deal with an embedded predominant part DLL to be loaded.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/span><\/h3>\n
Instructions configuration<\/h3>\n
A botnet operator can concern a complicated configuration to the bots by means of the administration panel. Bots are then ordered to carry out varied instructions in line with the directions obtained. Determine 13 exhibits an instance of such a command configuration.<\/p>\n
$\"Figure$
Determine 13. Dynamic configuration choices for the <\/em>FileGrabber<\/span> command<\/em><\/figcaption><\/figure>\n
Desk 3 lists the accessible instructions that may be issued. Every process has its personal particular choices to additional accommodate the operator\u2019s wants.<\/p>\n
Desk 3. Out there instructions<\/em><\/p>\n
<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Command<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Video<\/span><\/td>\n Report a video of the chosen software or web site.<\/td>\n<\/tr>\n
KeyLogger<\/span><\/td>\n Seize keystrokes from the chosen software.<\/td>\n<\/tr>\n
PostFilter<\/span><\/td>\n Seize info from sure web sites\u2019 types.<\/td>\n<\/tr>\n
WebInject<\/span><\/td>\n Permit Zeus-like webinjects on sure loaded web sites to change their perform.<\/td>\n<\/tr>\n
Redirect<\/span><\/td>\n Permit redirection of sure URLs.<\/td>\n<\/tr>\n
Block<\/span><\/td>\n Block entry to configured URLs.<\/td>\n<\/tr>\n
Screens<\/span><\/td>\n Take screenshots of a specific software or web site at sure intervals.<\/td>\n<\/tr>\n
Alerts<\/span><\/td>\n Permit notifications to be despatched to a specific Jabber account on a configurable occasion.<\/td>\n<\/tr>\n
Uninstall<\/span><\/td>\n Uninstall the bot from the system.<\/td>\n<\/tr>\n
UAC<\/span><\/td>\n Present assist for privilege escalation.<\/td>\n<\/tr>\n
FileGrabber<\/span><\/td>\n Permit sure information to be uploaded to the C&C if discovered on the sufferer\u2019s onerous disk.<\/td>\n<\/tr>\n
TorActive<\/span><\/td>\n Allow loading of a Tor module and permit connection through the Tor community if all C&C servers are inaccessible.<\/td>\n<\/tr>\n
Stealer<\/span><\/td>\n Allow\/disable the stealer performance and set its replace interval.<\/td>\n<\/tr>\n
TimeOut<\/span><\/td>\n Set interval for the bot to contact its C&C server.<\/td>\n<\/tr>\n
Set up<\/span><\/td>\n Configure the bot\u2019s set up on the system and its persistence.<\/td>\n<\/tr>\n
Exclusion<\/span><\/td>\n Set exclusions in Home windows Defender or Home windows Firewall for a specific course of.<\/td>\n<\/tr>\n
ConfigSave<\/span><\/td>\n Save the bot\u2019s configuration earlier than its termination.<\/td>\n<\/tr>\n
HideProcess<\/span><\/td>\n Conceal the bot\u2019s course of.<\/td>\n<\/tr>\n
CoreProtect<\/span><\/td>\n Permit the principle part to be injected into a further course of.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/span><\/h3>\n
Further payloads<\/h3>\n
Danabot additionally gives the aptitude to obtain and execute additional executable information. This characteristic permits the botnet operator to configure the set up of extra malware to the compromised system, as talked about earlier. Determine 14 exhibits accessible choices for this characteristic within the administration panel software.<\/p>\n
$\"Figure$
Determine 14. Choices for a further payload configuration<\/em><\/figcaption><\/figure>\n
Conclusion<\/h2>\n
Danabot is a large-scale MaaS operation distributing a wide selection of instruments for the malware associates\u2019 disposal. Our investigation of this infostealer, which began in 2018, resulted within the evaluation of Danabot\u2019s toolset offered on this blogpost. The efforts of the authorities and several other cybersecurity corporations, ESET included, led to the disruption of the malware\u2019s infrastructure. It stays to be seen whether or not Danabot can get better from the takedown. The blow will, nevertheless, absolutely be felt, since regulation enforcement managed to unmask a number of people concerned within the malware\u2019s operations.<\/p>\n
\n
For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com<\/a>.\u00a0<\/em><\/div>\n
ESET Analysis provides personal APT intelligence stories and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence<\/a> web page.<\/em><\/div>\n<\/blockquote>\n
IoCs<\/h2>\n
Information<\/h3>\n\n\n\n\n\n\n\n\n
SHA-1<\/strong><\/td>\n Filename<\/strong><\/td>\n Detection<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
6D361CD9ADBF1630AF7B323584168E0CBD9315FB<\/span><\/td>\n N\/A<\/td>\n Win32\/Spy.Danabot.X<\/td>\n Loader of the principle part (model 4006).<\/td>\n<\/tr>\n
A7475753CB865AEC8DC4A6CEA27F2AA594EE25E8<\/span><\/td>\n N\/A<\/td>\n Win32\/Spy.Danabot.O<\/td>\n Important part (model 4006).<\/td>\n<\/tr>\n
787EAB54714F76099EC350E029154ADFD5EDF079<\/span><\/td>\n N\/A<\/td>\n Win32\/Spy.Danabot.AC<\/td>\n Dropper part (model 3272).<\/td>\n<\/tr>\n
17B78AD12B1AE1C037C5D39DBE7AA0E7DE4EC809<\/span><\/td>\n 1c0e7316.exe<\/span><\/td>\n MSIL\/Kryptik.AMBV<\/td>\n Lockbit payload (variant Black) distributed by Danabot.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Community<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n
IP<\/strong><\/td>\n Area<\/strong><\/td>\n Internet hosting supplier<\/strong><\/td>\n First seen<\/strong><\/td>\n Particulars<\/strong><\/td>\n<\/tr>\n<\/thead>\n
212.18.104[.]245<\/span><\/td>\n N\/A<\/td>\n GLOBAL CONNECTIVITY SOLUTIONS LLP<\/td>\n 2025\u201103\u201125<\/td>\n Danabot proxy C&C server<\/td>\n<\/tr>\n
212.18.104[.]246<\/span><\/td>\n N\/A<\/td>\n GLOBAL CONNECTIVITY SOLUTIONS LLP<\/td>\n 2025\u201103\u201125<\/td>\n Danabot proxy C&C server<\/td>\n<\/tr>\n
34.16.215[.]110<\/span><\/td>\n N\/A<\/td>\n Google LLC<\/td>\n 2024\u201110\u201110<\/td>\n Danabot proxy C&C server<\/td>\n<\/tr>\n
34.65.116[.]208<\/span><\/td>\n N\/A<\/td>\n Google LLC<\/td>\n 2024\u201110\u201110<\/td>\n Danabot proxy C&C server<\/td>\n<\/tr>\n
34.168.100[.]35<\/span><\/td>\n N\/A<\/td>\n Google LLC<\/td>\n 2024\u201111\u201127<\/td>\n Danabot proxy C&C server<\/td>\n<\/tr>\n
N\/A<\/td>\n advanced-ip-scanned.com<\/span><\/td>\n N\/A<\/td>\n 2023\u201108\u201121<\/td>\n Misleading web site utilized in Danabot distribution<\/td>\n<\/tr>\n
N\/A<\/td>\n gfind.org<\/span><\/td>\n N\/A<\/td>\n 2022\u201106\u201115<\/td>\n Misleading web site utilized in Danabot distribution<\/td>\n<\/tr>\n
N\/A<\/td>\n mic-tests.com<\/span><\/td>\n N\/A<\/td>\n 2024\u201112\u201107<\/td>\n Misleading web site utilized in Danabot distribution<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
MITRE ATT&CK methods<\/h2>\n
This desk was constructed utilizing model 17<\/a> of the MITRE ATT&CK framework.<\/strong><\/em><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Tactic<\/strong><\/td>\n ID<\/strong><\/td>\n Title<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Useful resource Growth<\/strong><\/td>\n T1583.003<\/a><\/td>\n Purchase Infrastructure: Digital Non-public Server<\/td>\n Danabot operators use VPS of their infrastructure.<\/td>\n<\/tr>\n
T1583.004<\/a><\/td>\n Purchase Infrastructure: Server<\/td>\n Danabot operators purchase a number of servers for C&C communication.<\/td>\n<\/tr>\n
T1587.001<\/a><\/td>\n Develop Capabilities: Malware<\/td>\n Danabot authors have developed customized malware instruments.<\/td>\n<\/tr>\n
T1608.001<\/a><\/td>\n Stage Capabilities: Add Malware<\/td>\n Danabot operators add different malware to their infrastructure for additional spreading.<\/td>\n<\/tr>\n
T1583.008<\/a><\/td>\n Purchase Infrastructure: Malvertising<\/td>\n Malvertising is a well-liked technique of Danabot distribution.<\/td>\n<\/tr>\n
Preliminary Entry<\/strong><\/td>\n T1566.001<\/a><\/td>\n Phishing: Spearphishing Attachment<\/td>\n Phishing is a standard technique used for distribution.<\/td>\n<\/tr>\n
Execution<\/strong><\/td>\n T1106<\/a><\/td>\n Native API<\/td>\n Dynamic Home windows API decision is utilized by Danabot.<\/td>\n<\/tr>\n
T1204.001<\/a><\/td>\n Consumer Execution: Malicious Hyperlink<\/td>\n Luring customers into downloading Danabot through a malicious hyperlink is a well-liked distribution selection.<\/td>\n<\/tr>\n
T1204.002<\/a><\/td>\n Consumer Execution: Malicious File<\/td>\n Danabot is usually distributed as a file to be opened by the consumer.<\/td>\n<\/tr>\n
Privilege Escalation<\/strong><\/td>\n T1548.002<\/a><\/td>\n Abuse Elevation Management Mechanism: Bypass Consumer Account Management<\/td>\n A number of strategies are utilized by Danabot to bypass Consumer Account Management.<\/td>\n<\/tr>\n
Protection Evasion<\/strong><\/td>\n T1027.007<\/a><\/td>\n Obfuscated Information or Info: Dynamic API Decision<\/td>\n Danabot makes use of hashing for dynamic API decision.<\/td>\n<\/tr>\n
T1055.001<\/a><\/td>\n Course of Injection: Dynamic-link Library Injection<\/td>\n Danabot has the power to inject itself into different processes.<\/td>\n<\/tr>\n
T1218.007<\/a><\/td>\n System Binary Proxy Execution: Msiexec<\/td>\n An MSI package deal is likely one of the potential distribution strategies.<\/td>\n<\/tr>\n
T1218.010<\/a><\/td>\n System Binary Proxy Execution: Regsvr32<\/td>\n regsvr32.exe<\/span> can be utilized to execute the principle Danabot module.<\/td>\n<\/tr>\n
T1218.011<\/a><\/td>\n System Binary Proxy Execution: Rundll32<\/td>\n rundll32.exe<\/span> can be utilized to execute the principle Danabot module.<\/td>\n<\/tr>\n
T1656<\/a><\/td>\n Impersonation<\/td>\n Danabot makes use of impersonation in its phishing campaigns.<\/td>\n<\/tr>\n
Credential Entry<\/strong><\/td>\n T1555.003<\/a><\/td>\n Credentials from Password Shops: Credentials from Net Browsers<\/td>\n Danabot has the power to steal varied information from browsers.<\/td>\n<\/tr>\n
T1539<\/a><\/td>\n Steal Net Session Cookie<\/td>\n Danabot can steal cookies.<\/td>\n<\/tr>\n
Discovery<\/strong><\/td>\n T1010<\/a><\/td>\n Software Window Discovery<\/td>\n Danabot will be configured to steal information based mostly on the energetic window.<\/td>\n<\/tr>\n
T1217<\/a><\/td>\n Browser Info Discovery<\/td>\n Information, similar to shopping historical past, will be gathered by Danabot.<\/td>\n<\/tr>\n
T1083<\/a><\/td>\n File and Listing Discovery<\/td>\n Danabot will be configured to assemble sure information from the compromised file system.<\/td>\n<\/tr>\n
T1057<\/a><\/td>\n Course of Discovery<\/td>\n Danabot can enumerate operating processes on a compromised system.<\/td>\n<\/tr>\n
Lateral Motion<\/strong><\/td>\n T1021.001<\/a><\/td>\n Distant Providers: Distant Desktop Protocol<\/td>\n Danabot operators can use the distant desktop module to entry compromised techniques.<\/td>\n<\/tr>\n
T1021.005<\/a><\/td>\n Distant Providers: VNC<\/td>\n VNC is likely one of the supported options for controlling a compromised system.<\/td>\n<\/tr>\n
Assortment<\/strong><\/td>\n T1056.001<\/a><\/td>\n Enter Seize: Keylogging<\/td>\n Keylogging is considered one of Danabot\u2019s options.<\/td>\n<\/tr>\n
T1560.002<\/a><\/td>\n Archive Collected Information: Archive through Library<\/td>\n Danabot can use zlib and ZIP to compress collected information.<\/td>\n<\/tr>\n
T1560.003<\/a><\/td>\n Archive Collected Information: Archive through Customized Technique<\/td>\n Collected information is additional encrypted utilizing AES and RSA cyphers.<\/td>\n<\/tr>\n
T1119<\/a><\/td>\n Automated Assortment<\/td>\n Danabot will be configured to gather varied information routinely.<\/td>\n<\/tr>\n
T1185<\/a><\/td>\n Browser Session Hijacking<\/td>\n Danabot can carry out AitB assaults through webinjects.<\/td>\n<\/tr>\n
T1115<\/a><\/td>\n Clipboard Information<\/td>\n Danabot can acquire info saved within the clipboard.<\/td>\n<\/tr>\n
T1005<\/a><\/td>\n Information from Native System<\/td>\n Danabot will be configured to seek for delicate information on an area file system.<\/td>\n<\/tr>\n
T1113<\/a><\/td>\n Display screen Seize<\/td>\n Danabot will be configured to seize screenshots of functions and internet pages.<\/td>\n<\/tr>\n
T1125<\/a><\/td>\n Video Seize<\/td>\n Danabot can seize video from the compromised system.<\/td>\n<\/tr>\n
Command and Management<\/strong><\/td>\n T1132.001<\/a><\/td>\n Information Encoding: Normal Encoding<\/td>\n Visitors between bot and C&C server is compressed utilizing ZIP and zlib.<\/td>\n<\/tr>\n
T1001.001<\/a><\/td>\n Information Obfuscation: Junk Information<\/td>\n Junk bytes are added to information to be despatched between bot and C&C server.<\/td>\n<\/tr>\n
T1573.001<\/a><\/td>\n Encrypted Channel: Symmetric Cryptography<\/td>\n AES-256 is used as one of many encryption strategies of C&C communication.<\/td>\n<\/tr>\n
T1573.002<\/a><\/td>\n Encrypted Channel: Uneven Cryptography<\/td>\n RSA is used as one of many encryption strategies of C&C communication.<\/td>\n<\/tr>\n
T1008<\/a><\/td>\n Fallback Channels<\/td>\n The Tor module can be utilized as a fallback channel in case all common C&C servers should not responding.<\/td>\n<\/tr>\n
T1095<\/a><\/td>\n Non-Software Layer Protocol<\/td>\n Danabot makes use of its personal customized TCP protocol for communication.<\/td>\n<\/tr>\n
T1571<\/a><\/td>\n Non-Normal Port<\/td>\n Danabot can talk on any port.<\/td>\n<\/tr>\n
T1090.003<\/a><\/td>\n Proxy: Multi-hop Proxy<\/td>\n A sequence of proxy servers is used to cover the placement of the true C&C server.<\/td>\n<\/tr>\n
T1219<\/a><\/td>\n Distant Entry Software program<\/td>\n Danabot has assist for distant entry.<\/td>\n<\/tr>\n
Exfiltration<\/strong><\/td>\n T1020<\/a><\/td>\n Automated Exfiltration<\/td>\n Danabot will be configured to assemble varied information from a compromised system.<\/td>\n<\/tr>\n
T1030<\/a><\/td>\n Information Switch Dimension Limits<\/td>\n Danabot will be configured to keep away from sending massive information from a compromised system.<\/td>\n<\/tr>\n
T1041<\/a><\/td>\n Exfiltration Over C2 Channel<\/td>\n Gathered information is exfiltrated by means of commonplace C&C communication.<\/td>\n<\/tr>\n
Impression<\/strong><\/td>\n T1498<\/a><\/td>\n Community Denial of Service<\/td>\n Danabot employed a module to carry out varied DDoS assaults.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
$\"\"$ <\/a><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"
As introduced by the US Division of Justice \u2013 the FBI and US DoD\u2019s Protection Prison Investigative Service (DCIS) have managed to disrupt the infrastructure of the infamous infostealer, Danabot. ESET is likely one of the many cybersecurity corporations to take part on this long-term endeavor, changing into concerned again in 2018. Our contribution included […]<\/p>\n","protected":false},"author":2,"featured_media":2784,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[2693,2666,2517,2669],"class_list":["post-2782","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-analyzing","tag-danabot","tag-empire","tag-fallen"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/2782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2782"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/2782\/revisions"}],"predecessor-version":[{"id":2783,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/2782\/revisions\/2783"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/2784"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Function overview<\/h2>\nDanabot\u2019s authors have developed an enormous number of options to help prospects with their malevolent goals. Probably the most outstanding options provided by Danabot embody:<\/p>\n

Infrastructure<\/h2>\n

Internals<\/h2>\n

IoCs<\/h2>\n