These emails appeared as invoices from MYOB. Upon clicking the emails, users reach a compromised FTP server bearing the DanaBot malware. The technique arose as a robust phishing scam targeting various businesses, particularly in Australia. Researchers from Trustwave identified DanaBot’s association with this phishing campaign. Explaining about the phishing attack, the researchers state in their blog,
“We recently observed phishing emails targeting Australian customers with fake MYOB invoices. Instead of the usual HTTP links, these emails were ridden with FTP links pointing to compromised FTP servers. While most of the links to FTP sites are Australian domains, not all are. The FTP links were pointing to a zipped archive. This zipped archive contained a JavaScript that on execution downloads the DanaBot malware.”DanaBot Malware was first discovered by Proofpoint in May 2018 after noticing the massive phishing campaign targeting Australians. Later on, Trustwave researchers also posted a detailed analysis of the malware after observing the scam. It appears the phishing campaign is growing in the region over a period of time alongside improvisations in the DanaBot Trojan.
“The compromised FTP links point to a zipped archive (in this case 0987365299308858885968.zip), which gets downloaded onto the victim's computer upon clicking the invoice link. This zipped archive contains a JavaScript (JS) downloader. This JS requires the user to double-click to execute it. This launches a PowerShell command that would download the (DanaBot) malware binary "TempVBH56.exe", from the URL "hxxp://buy.biomixers[.]org/ZslSywnaWJ.php" and execute it silently on the system.”After that, the dropper file "TempVBH56.exe" executes the downloader, which then executes the DanaBot Master in a cascade. The DanaBot Master then further downloads an encrypted file that contains various modules and configurations files and decrypts it.
“The filenames of the DLLs extracted from the encrypted file reveal the true intention of the attackers. In essence, these DLLs enable the attacker to create and control a remote host via VNC, steal private and sensitive information and use covert channels via Tor.”Besides giving the access of the infected device to the hacker, DanaBot can also send screenshots of the machine to the C&C.
At the moment, the malware seems restricted to Australia. However, nobody knows when this malware begins targeting users in others parts of the world. Users, particularly the SMBs, need to remain wary of these phishing scams by avoiding clicking on any emails unless they are sure of the senders.
Let us know what you think in the comments section.
