DanaBot: what it is and how to remove it

From our report of May 2020 · not reviewed since

DanaBot trojan gathers sensitive information from the infiltrated system and includes ransomware-type virus features

DanaBot - malware that spreads using spam email campaigns and malicious file attachments.

Creators put malware scripts into the MS Office documents and send thousands of questionable emails to users. When any gullible user receives the notification and goes through downloading and opening the file triggers the launch of the trojan virus. There is not much that the user needs to do because malicious scripts get enabled by pressing one button on the document when it is opened on the computer directly.

DanaBot Trojan started as a typical banking trojan and traveled through users' devices gathering sensitive data, planting other threats, and damaging machines. Later on, in 2019 the threat was upgraded and became a powerful threat that targets companies all over the world.

First targets were Australia, and some countries in Europe and malware evolved to modular malware that can download and launch DLL files, inject scripts on banking sites and steal information from various sites and the infected computer.

It is known that the DanaBot virus can manipulate browser sessions and redirect visits to financial services and steal credentials when users submit them to log in. Malware is capable of taking screenshots of the desktop, transfer all the stolen data to the C&C server that hackers control, and use such details to make fraudulent transactions, and steal money from banking accounts directly.

DanaBot trojan started with attacks targeting Australian banks, and other hackers managed to get the malware as a part of the affiliate system. When malicious actors use, rent or purchase the trojan they share profits with developers, and a team that created trojan in the first place can make a profit no matter what.

DanaBot trojan is compared to Zeus virus because it has many functions as a banking trojan and downloader components, including web injects that the Zeus is known for.

It gets upgrades and is used for different purposes since the malware can be used as a tool of exfiltrating data. It is often using browsers and OS fingerprinting to deliver the fake website copies in the place of legitimate banking domains or e-commerce services.

It even masks C2 communications and requests updates by relying on the Tor module. DanaBot virus can target larger businesses and reduce the number of attacks while focusing on quality and choose to profile the victims' worth before running the malware. This is how attackers ensure to make more profit.

DanaBot malware upgrades revealed that threat included some capabilities besides those info-stealing functions:

It also involved in ransomware-type campaigns when DanaBot encrypted files. Non-ransomware appended files using .non and .bkc extensions before dropping the HowToBackFiles.txt file containing the message for victims. At the time, this functionality was associated with Blitzkrieg ransomware activities.

When this not ransomware function affected files, DanaBot virus added files in system folders could trigger various processes. Malware can disable disk restoration, services, programs, monitoring software, and Windows Defender or other AV tools.

Trojan can delete shadow copies and clear EventLog or different folders and directories. Ransomware can be designed to revive itself after the killing by adding the scheduled task using the modified Schtasks tool. At the time researchers explained:

DanaBot ransomware has a tool that can be launched as a decryptor that you can find here.

DanaBot is the banking trojan that actively gets updates and techniques targeted towards avoiding the detection and maintaining continuous operations. Attackers aim for financial gain, so financial rewards can be ensured when all the functions run uninterrupted. New tactics and operations can emerge, and since targets mainly are financial institutions and e-commerce, streaming services there are many places where the threat can spread and act further.

DanaBot malware is linked with other threats, and the relations were confirmed in the past, so same injection patterns and progression can show that this trojan will continue to be one of the most dangerous banking trojans in the future. Organizations should be aware of potential targeting and keep these malware campaigns in mind.

To avoid DanaBot removal, organizations can implement fraud detections within their web platforms. Detecting banking trojans and blocking fraudulent transactions can combat phishing attacks ant these fraud tactics that result in losses of money and sensitive data.

As for users that needed to remove DanaBot and fight malware on the machine, changing email addresses, logins and usernames on other platforms could be a great step once the system is cleared. Intrusion detection systems, anti-malware tools, and other antivirus programs are the best for the initial virus termination.

However, there are still issues with virus damage that is leftover after the DanaBot trojan attack. Affected system functions, damaged files or folders, and entries in places like Windows registries can create issues after the malware is terminated.

Such alterations often happen to trigger detection avoidance and persistence of the threat, especially when it comes to ransomware-type viruses. Get a proper tool like for PC repair purposes and system optimization to find and fix issues with damage and changed settings.

• stealing browser client credentials;
• collecting logins to crypto wallet services;
• running a proxy on the infected machine;
• web injects;
• requesting updates via the Tor browser.

From our report of May 2020 · not reviewed since

DanaBot trojan termination tips and precautionary measures listed

Since the DanaBot virus can run in the background unnoticed and unexpected it is more dangerous than any other threat.

There are many functions in addition to banking trojan and password-stealing features, so full system cleaning is the only solution when dealing with this threat. Do not forget that even though these malware campaigns more targeted towards businesses, everyday users can also receive malicious emails with the trojan payload.

To avoid DanaBot removal in the future, you should have security or optimization tools like on the machine and run them more often, so all the issues, alterations, and damage can get fixed in time. This way there are no flaws in the system that attackers could exploit and spread their products.

When the process of DanaBot removal is inevitable, rely on proper tools, official providers, and sources that distribute , , or any other reliable anti-malware tool. These programs can check various parts where the attackers planted their malicious scripts. In addition to the software, you can reboot the machine in Safe Mode with Networking, so the functions that get disabled can freely run, and your AV tool is not blocked.

[GI=method-1]When a threat is affecting the performance and disabling some functions, rebooting the PC in Safe Mode with Networking can help with DanaBot removal

[GI=method-2]System Restore is the function that can give the opportunity of recovering machine in a previous state when the trojan was not active

From our report of May 2020 · not reviewed since

More from our earlier report on DanaBot

• DanaBot removal requires proper tools because not all files and programs associated with the trojan can be found or seen, so anti-malware tools can detect and clear all the malware traces automatically
• Some settings and features of the infected machine can get affected by the threat.
• Especially when system files and folders get affected and corrupted, so run for the best virus damage fixing results
• The ransomware enumerates logical drives, visits all the directories except Windows, and encrypts all the files using AES128.
• The password is a string representation of the system volume serial number.
• Every file is encrypted in a separate thread.

From our report of May 2020 · not reviewed since

Email campaigns circulate on the internet with subject lines claiming about invoices, e-tools, order information, and other details that help trick people into opening notifications and download malicious files without batting an eye. Microsoft Word attachments include macro viruses that get enabled by few clicks on the screen and triggers PowerShell or different functions to load malware payload directly on the system.

Then malware triggers all the processes, manipulates browser sessions, pulls other modules and inject sites, steals information without any symptoms created. The infection can be avoided, but not easily noticed if you do not pay attention to the email, sender, and topics of these emails.

When you notice any suspicious emails that you were not expecting to receive and notifications include file attachments or links you need to pay attention to other details because any red flag can indicate malicious behavior and purposes of the email, files included on it.

Delete any suspicious messages and do not open files that you are not sure about. Financial-themed emails are not coming randomly from services and platforms, so do not fall for such tricks.