Live Stream VOD: Danabot Core Triage Part 2 - Delphi Structs and IDA (Patreon)

In this stream we continue our analysis of Danabot with a focus on the core component. Danabot is written in Delphi which requires some additional tooling on top of IDA to reverse engineer.

Building on our use of  IDR in the last stream, we extract the "record" metadata (struct) and use it to identify key information in the binary. We also demonstrate how to diff an older version of the malware records with a new version to quickly identify changes and updates!

Samples

• Older version of Danabot core used for reference 77ff83cc49d6c1b71c474a17eeaefad0f0a71df0a938190bf9a9a7e22531c292
• Packed "loader" used to distribute new core 97cdac23e6b4a18d9dd86a4d21ce9e7e0f719806b34e0cf7f68f002f1cdcc84b
• Unpacked new core 755fd2c9045fa4fc3e4bd4319245418053fc7b4db9e072ec16aac6b854cadaaf

Notes

DanaBot Core - Taking a look at a new version of the DanaBot Core