DanaBot: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "Embarcadero Delphi (PE32 / Borland 32-bit)",
  "runtime": "Delphi Visual Component Library (VCL) and Run-Time Type Information (RTTI)",
  "binary_footprint": "Multi-stage architecture; Stage 1 stager typ. 300 KB - 600 KB; core orchestrator DLL typ. 200 KB",
  "stub_size": "458,752 bytes (typical Delphi stager binary), containing embedded VCL runtime classes",
  "packer_obfuscation": "Custom Delphi crypter stagers, API hashing, encrypted resource sections, and string XOR encryption",
  "subsystem": "Windows GUI (Subsystem 2)",
  "entry_point_flow": "Delphi initialization -> Decrypts embedded C2 IP list and RSA public key -> Performs anti-analysis checks -> Initiates raw TCP connection to C2 port (e.g. 443/10443) -> Performs RSA-2048 handshake exchanging AES session key -> Downloads and reflectively loads modular DLL plugins (Sniffer, VNC, Stealer, Tor) -> Injects root CA certificate into Windows Certificate Store -> Activates local proxy and browser web injects",
  "technical_summary": "DanaBot is an enterprise-grade modular banking Trojan and stealer authored in Embarcadero Delphi. Its architecture consists of a primary stager, a memory-resident core orchestrator, and an extensible suite of task-specific plugin DLLs downloaded dynamically on demand. DanaBot establishes persistent command-and-control over raw binary TCP sockets or through embedded Tor client modules, securing communications via an RSA-2048 handshake followed by AES-256 encrypted packet streaming. Its financial fraud capability relies on installing a rogue root Certificate Authority (CA) into the local Windows store to perform transparent SSL/TLS interception and web injection attacks on banking sessions."
}

{
  "type": "Web Management Panel (PHP/Node.js) & Delphi Operator Builder",
  "builder_tabs": [
    "Campaign Configuration (Affiliate ID, Project Tag, C2 IP list, Fallback Tor Onion addresses)",
    "Builder & Crypter (Delphi stub generation, anti-analysis toggles, UAC bypass methods)",
    "Web Injections Manager (Target bank URL regexes, fraudulent HTML/JS form injects)",
    "Live VNC & Proxy Console (Hidden desktop monitoring, reverse proxy tunnel management)"
  ],
  "config_fields": [
    {
      "offset": "0x0000",
      "field": "Affiliate_ID",
      "type": "DWORD",
      "description": "Affiliate team identifier number"
    },
    {
      "offset": "0x0004",
      "field": "C2_List",
      "type": "Encrypted String Array",
      "description": "List of primary and backup C2 IP addresses and ports"
    },
    {
      "offset": "0x0080",
      "field": "RSA_Public_Key",
      "type": "Byte Array (256 bytes)",
      "description": "Raw ASN.1/DER formatted RSA-2048 public key modulus"
    },
    {
      "offset": "0x0180",
      "field": "Tor_Onion_Host",
      "type": "Encrypted ASCII String",
      "description": "Fallback .onion hidden service address"
    },
    {
      "offset": "0x01C0",
      "field": "Sleep_Interval",
      "type": "DWORD",
      "description": "Heartbeat beaconing delay in seconds"
    }
  ],
  "payload_generation_flags": [
    "Runtime: Embarcadero Delphi PE32",
    "Communication Mode: Raw TCP Sockets / Tor Fallback",
    "Cryptographic Handshake: RSA-2048 + AES-256-CBC",
    "MitM Module: Auto-Inject Rogue Root CA"
  ],
  "operator_commands": [
    "0x10: Download and execute modular plugin DLL in-memory",
    "0x11: Update web injection rule configuration for banking targets",
    "0x12: Initialize reverse VNC connection for hidden desktop manipulation",
    "0x13: Initiate browser credential and cryptocurrency wallet extraction",
    "0x14: Establish reverse SOCKS proxy tunnel through victim host",
    "0x15: Terminate bot and wipe local registry artifacts"
  ],
  "interface_telemetry_analysis": "The DanaBot administration interface is a sophisticated web console providing real-time oversight of bot cohorts. It tracks compromised banking credentials, live VNC sessions, and active proxy connections. The console allows operators to dynamically assign injection scripts to specific banking targets, deploy specialized sniffing modules to high-value endpoints, and export stolen cryptocurrency wallet data and browser credential stores."
}

struct DanaBot_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Modular DLL Injection & Certificate Injection: DanaBot stager downloads encrypted plugin modules -> Reflectively maps DLLs into memory using custom Delphi PE loader routines -> Installs rogue self-signed Certificate Authority (CA) into Windows Certificate Store (CERT_SYSTEM_STORE_CURRENT_USER\\Root) using CertAddCertificateContextToStore from crypt32.dll -> Spawns browser processes (chrome.exe, msedge.exe, firefox.exe) -> Injects sniffer DLL into browser memory to intercept decrypted TLS traffic and apply DOM web injections.",
  "ntapi_functions": [
    "crypt32!CertOpenSystemStoreW",
    "crypt32!CertAddCertificateContextToStore",
    "crypt32!CertCloseStore",
    "kernel32!VirtualAlloc",
    "kernel32!VirtualProtect",
    "ws2_32!WSAStartup",
    "ws2_32!connect",
    "ws2_32!send",
    "ws2_32!recv"
  ],
  "process_hollowing_target": "chrome.exe, msedge.exe, firefox.exe, or svchost.exe",
  "persistence_mechanics": [
    "Scheduled Task: Creation of task running under user context with random task naming",
    "Registry Run Key: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry pointing to dropped stager",
    "Service Installation: On systems with administrative privileges, registers as a Windows service"
  ],
  "evasion_hooks": [
    "Rogue Root CA Injection: Injects self-signed CA certificate directly into Windows Certificate Store, allowing local MitM proxy to inspect and modify TLS traffic without browser security warnings",
    "In-Memory Plugin Loading: Executes secondary DLLs without writing functional modules to disk",
    "Delphi VCL Obfuscation: Complex Delphi runtime object trees obfuscate program flow and disrupt static decompiler analysis"
  ],
  "anti_analysis": [
    "Validates system language settings via GetUserDefaultUILanguage, aborting execution on specific Eastern European locales",
    "Detects virtualized environments by checking for VMware/VirtualBox registry keys and disk drive model strings",
    "Checks for active monitoring tools (Wireshark, Fiddler, Process Explorer, x64dbg) via process enumeration"
  ]
}

Concrete technical breakdown of functional modules implemented in the DanaBot binary:

{
  "framing": "Raw TCP binary socket stream over ports 443, 10443, or custom ports. Handshake utilizes RSA-2048 to negotiate an AES-256 session key. Subsequent packets feature a 16-byte fixed binary header followed by AES-encrypted, compressed payload data.",
  "serialization": "Proprietary Delphi binary struct serialization, compressed via zlib or FastLZ algorithms",
  "handshake": "Client opens raw TCP socket -> Generates random 32-byte AES key and 16-byte IV -> Encrypts session key and initial registration block using embedded RSA-2048 public key -> Transmits 256-byte RSA ciphertext -> Server decrypts with private RSA key and initializes AES session -> Bi-directional encrypted binary streaming commences",
  "cryptography": "RSA-2048 (PKCS#1 v1.5 padding) for session key exchange. AES-256-CBC with PKCS7 padding for all subsequent binary packet streaming. Checksums calculated via Adler-32 or CRC32.",
  "packet_types": [
    {
      "header": "0x00000100 (Handshake)",
      "payload": "256-byte RSA-2048 encrypted block containing AES key, IV, and bot registration data",
      "direction": "Client -> Server"
    },
    {
      "header": "0x00000200 (Module Request)",
      "payload": "Request downloading specific plugin module (Sniffer, VNC, Stealer)",
      "direction": "Client -> Server"
    },
    {
      "header": "0x00000300 (Module Dispatch)",
      "payload": "AES-encrypted, zlib-compressed DLL module binary",
      "direction": "Server -> Client"
    },
    {
      "header": "0x00000400 (Data Exfil)",
      "payload": "AES-encrypted stolen credentials, web form inputs, and keystroke logs",
      "direction": "Client -> Server"
    }
  ],
  "traffic_signature": "Outbound raw TCP connections to remote IP addresses on non-standard ports (e.g. 10443) initiating with a 256-byte high-entropy binary burst (RSA block), followed by structured binary frames with fixed 16-byte headers."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: