win.danabot (Back to overview)

DanaBot

URLhaus    

Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on “quality over quantity” in email-based threats. DanaBot’s modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.

References
https://0ffset.wordpress.com/2018/06/05/post-0x08-analyzing-danabot-downloader/
https://asert.arbornetworks.com/danabots-travels-a-global-perspective/
https://blog.yoroi.company/research/dissecting-the-danabot-paylaod-targeting-italy/
https://research.checkpoint.com/danabot-demands-a-ransom-payment/
https://www.fortinet.com/blog/threat-research/breakdown-of-a-targeted-danabot-attack.html
https://www.gdatasoftware.com/blog/2019/05/31695-strange-bits-smuggling-malware-github
https://www.proofpoint.com/us/threat-insight/post/danabot-control-panel-revealed
https://www.proofpoint.com/us/threat-insight/post/danabot-gains-popularity-and-targets-us-organizations-large-campaigns
https://www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0
https://www.trustwave.com/Resources/SpiderLabs-Blog/DanaBot-Riding-Fake-MYOB-Invoice-Emails/
https://www.welivesecurity.com/2018/09/21/danabot-targeting-europe-adds-new-features/
https://www.welivesecurity.com/2018/12/06/danabot-evolves-beyond-banking-trojan-new-spam/
https://www.welivesecurity.com/2019/02/07/danabot-updated-new-cc-communication/
Yara Rules
[TLP:WHITE] win_danabot_auto (20190620 | autogenerated rule brought to you by yara-signator)
rule win_danabot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2019-07-05"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.2a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot"
        malpedia_version = "20190620"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { 6a00 6a00 6803800000 8b45f4 50 }
            // n = 5, score = 1500
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6803800000           | push                0x8003
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   50                   | push                eax

        $sequence_1 = { 6a00 6a00 6803800000 8b45f4 }
            // n = 4, score = 1500
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6803800000           | push                0x8003
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]

        $sequence_2 = { 50 6a00 6a00 6803800000 8b45f4 }
            // n = 5, score = 1500
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6803800000           | push                0x8003
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]

        $sequence_3 = { 50 6a00 6a00 6803800000 8b45f4 50 }
            // n = 6, score = 1500
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6803800000           | push                0x8003
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   50                   | push                eax

        $sequence_4 = { 50 6a00 6a00 6803800000 8b45f4 }
            // n = 5, score = 1500
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6803800000           | push                0x8003
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]

        $sequence_5 = { 6a00 6a00 6803800000 8b45f4 }
            // n = 4, score = 1500
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6803800000           | push                0x8003
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]

        $sequence_6 = { 6a00 6803800000 8b45f4 50 }
            // n = 4, score = 1500
            //   6a00                 | push                0
            //   6803800000           | push                0x8003
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   50                   | push                eax

        $sequence_7 = { 68000000f0 6a01 6a00 6a00 8d45e8 50 }
            // n = 6, score = 1400
            //   68000000f0           | push                0xf0000000
            //   6a01                 | push                1
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax

        $sequence_8 = { 68000000f0 6a01 6a00 6a00 8d45e8 }
            // n = 5, score = 1400
            //   68000000f0           | push                0xf0000000
            //   6a01                 | push                1
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   8d45e8               | lea                 eax, [ebp - 0x18]

        $sequence_9 = { 8d45f0 50 6a00 6a00 6803800000 8b45f4 50 }
            // n = 7, score = 1200
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6803800000           | push                0x8003
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   50                   | push                eax

        $sequence_10 = { 8b45a4 8d4da8 33d2 e8???????? }
            // n = 4, score = 1100
            //   8b45a4               | mov                 eax, dword ptr [ebp + 0x34]
            //   8d4da8               | add                 eax, 4
            //   33d2                 | cvtsi2sd            xmm0, eax
            //   e8????????           |                     

        $sequence_11 = { e8???????? 8b45a4 8d4da8 33d2 e8???????? }
            // n = 5, score = 1100
            //   e8????????           |                     
            //   8b45a4               | dec                 eax
            //   8d4da8               | mov                 dword ptr [ebp + 0x48], 0
            //   33d2                 | nop                 
            //   e8????????           |                     

        $sequence_12 = { e8???????? 8b45a4 8d4da8 33d2 }
            // n = 4, score = 1100
            //   e8????????           |                     
            //   8b45a4               | mov                 eax, 0x47
            //   8d4da8               | cmp                 eax, dword ptr [ebp + 0x64]
            //   33d2                 | mov                 ecx, dword ptr [ebp + 0x34]

        $sequence_13 = { 50 8b45e8 50 ff15???????? 85c0 0f8????????? }
            // n = 6, score = 1100
            //   50                   | dec                 eax
            //   8b45e8               | lea                 ecx, [0x55c60]
            //   50                   | dec                 eax
            //   ff15????????         |                     
            //   85c0                 | movzx               eax, word ptr [ebp + 0x36]
            //   0f8?????????         |                     

        $sequence_14 = { 8d4da8 33d2 e8???????? 8b45a8 50 8d45a0 e8???????? }
            // n = 7, score = 1000
            //   8d4da8               | cmp                 word ptr [0x55c77], ax
            //   33d2                 | mov                 eax, dword ptr [ebp - 0x5c]
            //   e8????????           |                     
            //   8b45a8               | lea                 ecx, [ebp - 0x58]
            //   50                   | xor                 edx, edx
            //   8d45a0               | mov                 eax, dword ptr [ebp - 0x5c]
            //   e8????????           |                     

        $sequence_15 = { 7d?? a1???????? a3???????? a1???????? 3b05???????? 74?? }
            // n = 6, score = 1000
            //   7d??                 |                     
            //   a1????????           |                     
            //   a3????????           |                     
            //   a1????????           |                     
            //   3b05????????         |                     
            //   74??                 |                     

        $sequence_16 = { a3???????? a1???????? 0305???????? 8b15???????? 0315???????? }
            // n = 5, score = 1000
            //   a3????????           |                     
            //   a1????????           |                     
            //   0305????????         |                     
            //   8b15????????         |                     
            //   0315????????         |                     

        $sequence_17 = { 3b05???????? 7e?? c705???????????????? a1???????? 0305???????? 8b15???????? 0315???????? }
            // n = 7, score = 1000
            //   3b05????????         |                     
            //   7e??                 |                     
            //   c705????????????????     |     
            //   a1????????           |                     
            //   0305????????         |                     
            //   8b15????????         |                     
            //   0315????????         |                     

        $sequence_18 = { e8???????? 2bd8 81fbf41f0000 7e?? }
            // n = 4, score = 500
            //   e8????????           |                     
            //   2bd8                 | sub                 ebx, eax
            //   81fbf41f0000         | cmp                 ebx, 0x1ff4
            //   7e??                 |                     

        $sequence_19 = { 8b0d7c7e0400 e8???????? 4885c0 75?? 488b0547390500 }
            // n = 5, score = 100
            //   8b0d7c7e0400         | lea                 edx, [0x29f76]
            //   e8????????           |                     
            //   4885c0               | inc                 ecx
            //   75??                 |                     
            //   488b0547390500       | mov                 eax, 0x100

        $sequence_20 = { 89859c030000 488d4d38 488d15769f0200 41c7c000010000 }
            // n = 4, score = 100
            //   89859c030000         | mov                 dword ptr [ebp + 0x39c], eax
            //   488d4d38             | dec                 eax
            //   488d15769f0200       | lea                 ecx, [ebp + 0x38]
            //   41c7c000010000       | dec                 eax

        $sequence_21 = { 4c8b8508020000 4c8b8d00020000 488d05ca170000 4889442420 e8???????? 488d8df8010000 }
            // n = 6, score = 100
            //   4c8b8508020000       | dec                 eax
            //   4c8b8d00020000       | mov                 eax, dword ptr [0x53947]
            //   488d05ca170000       | test                ecx, ecx
            //   4889442420           | nop                 
            //   e8????????           |                     
            //   488d8df8010000       | dec                 eax

        $sequence_22 = { 85c9 75?? 90 488d05ee960500 }
            // n = 4, score = 100
            //   85c9                 | mov                 ecx, dword ptr [0x47e7c]
            //   75??                 |                     
            //   90                   | dec                 eax
            //   488d05ee960500       | test                eax, eax

        $sequence_23 = { 8b85cc000000 0faf85d4000000 8985d0000000 c7c047000000 }
            // n = 4, score = 100
            //   8b85cc000000         | lea                 eax, [0x596ee]
            //   0faf85d4000000       | dec                 esp
            //   8985d0000000         | mov                 eax, dword ptr [ebp + 0x208]
            //   c7c047000000         | dec                 esp

        $sequence_24 = { 3b4564 7e?? 8b4d34 e8???????? 8b4534 83c004 f20f2ac0 }
            // n = 7, score = 100
            //   3b4564               | mov                 ecx, dword ptr [ebp + 0x200]
            //   7e??                 |                     
            //   8b4d34               | dec                 eax
            //   e8????????           |                     
            //   8b4534               | lea                 eax, [0x17ca]
            //   83c004               | dec                 eax
            //   f20f2ac0             | mov                 dword ptr [esp + 0x20], eax

        $sequence_25 = { 48c7454800000000 90 488d0d605c0500 e8???????? 480fb74536 663905775c0500 75?? }
            // n = 7, score = 100
            //   48c7454800000000     | dec                 eax
            //   90                   | lea                 ecx, [ebp + 0x1f8]
            //   488d0d605c0500       | mov                 eax, dword ptr [ebp + 0xcc]
            //   e8????????           |                     
            //   480fb74536           | imul                eax, dword ptr [ebp + 0xd4]
            //   663905775c0500       | mov                 dword ptr [ebp + 0xd0], eax
            //   75??                 |                     

    condition:
        7 of them
}
Download all Yara Rules