How to remove Dante spyware from infected devices

What kind of malware is Dante?

Dante is a sophisticated spyware used for targeted espionage. The attacks involve a persistent loader and a backdoor called LeetAgent for post-exploitation access. Dante is deployed via phishing emails that exploit a vulnerability in a Chrome browser. Its primary purpose is to collect data from organizations in the media, research, government, and finance sectors.

More about Dante

During the delivery of Dante, the first step in the attack chain is a small validator script that runs in the victim's browser to confirm the visitor is a real user, and then securely fetches and executes the next stage of the attack.

Persistence is achieved by using a technique that allows cybercriminals to override a Windows registry entry, causing the system to load their malicious DLL instead of the genuine component. That DLL acts as a loader, checking which process it is running in, decrypting the main malware, and launching it using shellcode.

Also, the attack involves LeetAgent, a tool that can run shell commands, start programs, read and write files, inject shellcode, change folders, and manage tasks. It also runs a keylogger and a file stealer that looks for common document types (.doc, .docx, .pdf, .ppt, .pptx, .rtf, .xls, and .xlsx.).

In attacks involving Dante, LeetAgent acts as the first-stage malware, which launches Dante. Dante is designed to avoid detection and analysis. It uses VMProtect to hide its code and make debugging difficult. It also checks for debuggers, virtual machines, and analysis tools and inspects Windows event logs to avoid detection.

Moreover, if Dante does not get any commands for a specified number of days, it removes itself and wipes all traces of its activity. It is worth noting that there is not much information available on Dante's modules, so its full spying capabilities and exactly what data it steals are still unknown.

Conclusion

Dante is spyware delivered through a multi-stage attack involving a validator script, a persistent loader, and LeetAgent as the first-stage malware. During observed attacks, the malware could evade detection, anti-debugging, and environment checks. While some capabilities are known, the full extent of its data collection capabilities is not yet clear.

How did Dante infiltrate my computer?

In known cases, Dante was delivered through spear-phishing emails that looked like legitimate invitations to a scientific forum. Clicking the link took the victim to a malicious website, which verified the user and ran the exploit to start the infection. The emails were carefully crafted to appear authentic and track who clicked the links.

Other common ways of malware distribution are pirated software, cracking tools, key generators, tech support scams, malicious advertisements, and similar channels.

How to avoid installation of malware?

Always download apps from official websites or app stores, and avoid pirated software, cracks, or keygens. Be cautious with emails - do not open irrelevant, unexpected attachments or links from unknown senders. Avoid clicking on ads, links, pop-ups, or buttons on questionable sites, and never allow the sites to show notifications.

Regularly update installed software and the operating system, and run security scans using a reliable security tool. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Malicious email distributing Dante (source: securelist.com):

Text in this email (translated from Russian):

On behalf of the Organizing Committee of the "Primakov Readings" and the Primakov Institute of World Economy and International Relations of the Russian Academy of Sciences, we have the honor to invite you to take part in the international forum "Primakov Readings", which will be held on June 23-25 at the Moscow International Trade Center and IMEMO RAS.

You can download the official invitation, preliminary program and list of participants on the official website at the link Personal account of the forum guest . To participate in the forum, please fill out the form at the link: Forum participant form

Sincerely,
International forum
"Primakov Readings"

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is Dante?
• STEP 1. Manual removal of Dante malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with Dante spyware, should I format my storage device to get rid of it?

Formatting the device is unnecessary. Malware such as Dante is often removable with trusted antivirus or anti-malware tools like Combo Cleaner.

What are the biggest issues that malware can cause?

Malware enables cybercriminals to remotely control infected devices, steal sensitive information (for example passwords or credit card details), hijack accounts, encrypt data, drop additional payloads, and carry out other harmful actions.

What is the purpose of Dante?

Dante is spyware, a type of malware designed to secretly monitor and collect data from a target system.

How did Dante infiltrate my computer?

Dante was observed being delivered via spear-phishing emails disguised as legitimate forum invitations, which led victims to a malicious site that ran the exploit. Malware can also spread through pirated software, cracks, keygens, tech support scams, malicious ads, and similar methods.

Will Combo Cleaner protect me from malware?

Yes, Combo Cleaner is capable of detecting and removing most known malware. Because advanced threats can hide deep in the system, running a full system scan is essential to fully eliminate them.