DanaBot is a sophisticated, modular malware family first identified in May 2018. It began as a banking trojan but evolved into a versatile malware-as-a-service (MaaS) platform, enabling a range of cybercriminal activities including information theft, wire fraud, cryptocurrency theft, and acting as a loader for other malware families.
Key Features and Capabilities
• DanaBot consists of three main components: a loader, a main module, and a set of attacker-specified modules. This modularity allows attackers to tailor the malware for specific campaigns, enabling functions such as credential theft, remote access, keylogging, screenshot capture, and system reconnaissance.
Stealth and Persistence
• The malware employs advanced obfuscation techniques, including junk code, encryption (AES and RSA), Windows API hashing, and multiple layers of communication encryption, making analysis and detection challenging.
• It establishes persistence through hidden files, new service creation, and DLL hijacking, particularly exploiting the Windows Update Standalone Installer (wusa.exe).