Danabot

Category: banking_trojan · Aliases: DanaBot, Trojan.DanaBot, Win32/DanaBot, Backdoor.DanaBot, Delphi.DanaBot · Sample count (EMBER 2018): 32 · Enrichment: curated_sourced · Updated: 2026-10-16
Category: Banking_TrojanStatus: Automated SignaturePlatform: WINDOWS, WINDOWS_PEStage: Initial Access, Execution, Persistence, Defense Evasion, Credential Access, Discovery, Collection, Command And Control, Exfiltration🕸 Explore Relationship Graph⚙ API JSON⚡ Sigma Rule💾 YARA RuleOS: Windows 11, Windows 10, Windows Server 2022
Executive Summary
DanaBot is a sophisticated modular banking trojan, stealer, and loader platform first identified in May 2018 by Proofpoint security researchers.

Table of Contents

Overview

DanaBot is a sophisticated modular banking trojan, stealer, and loader platform first identified in May 2018 by Proofpoint security researchers. Authored in Embarcadero Delphi, DanaBot is operated under an affiliate-driven Malware-as-a-Service (MaaS) distribution model by Russian-speaking cybercrime groups closely associated with threat actors TA505 and TA511. DanaBot is distributed primarily via high-volume malicious spam (malspam) campaigns mimicking urgent accounting invoices, utility notices, and postal tracking receipts. These emails deliver weaponized Microsoft Office attachments exploiting Equation Editor memory corruption (CVE-2017-11882) or MSHTML remote code execution (CVE-2021-40444), as well as Google Search ad clicks leading to malicious software installers. The architecture of DanaBot is built around a compact primary loader and a suite of dynamically downloaded secondary DLL modules. The loader establishes encrypted communications with C2 nodes over custom binary protocols wrapped in AES and XOR encryption. Uniquely, DanaBot implements a resilient decentralized fallback communication layer utilizing the Bitmessage peer-to-peer network and Tor hidden service routing nodes to receive updated C2 IP addresses in case primary infrastructure is seized. Its operational modules include a browser web-inject module that hooks Chrome, Firefox, and Edge to execute Man-in-the-Browser (MitB) financial diversion; a reverse SOCKS proxy module allowing attackers to funnel unauthorized banking transactions through the victim's residential IP; a custom VNC module for live desktop control; and an aggressive credential-stealing module that extracts passwords, browser cookies, and cryptocurrency wallets from over 50 applications.

Known aliases

Threat reports may refer to this family under multiple names:

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Danabot_Delphi · Danabot_Bitmessage_C2 · Danabot_V2020

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1055 · T1056.001 · T1113 · T1071.001 · T1547.001 · T1572 · T1090.001 · T1555.003 · T1185

→ Explore the complete 226-Technique ATT&CK Threat Matrix

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

D3FEND IDCountermeasure NameTacticCountered ATT&CKDefensive Guidance
D3-PIADProcess Injection Analysis & DetectionDetectT1055Monitor cross-process thread creation (CreateRemoteThread) and asynchronous procedure calls (QueueUserAPC).
D3-MFAMulti-factor AuthenticationHardenT1056.001Enforce FIDO2 / WebAuthn physical tokens to render keystroke-intercepted passwords useless.
D3-WAFWeb Content Filtering & InspectionFilterT1071.001Block newly registered domains (NRDs) and inspect HTTP Host and URI headers for known C2 profiles.
D3-OAAOutbound Network Traffic FilteringIsolateT1090.001Restrict outbound connections to known external proxy relays and enforce enterprise forward proxy authentication.
D3-SDScreen Capture DetectionDetectT1113Monitor desktop graphics API calls (BitBlt, GetDC) triggered by non-standard background threads.
D3-MitBAMan-in-the-Browser AnalysisDetectT1185Deploy browser extension whitelisting and hardware-backed session binding to prevent rogue DOM and socket injection.
D3-RPMRegistry Persistence MonitoringDetectT1547.001Audit and restrict write privileges to user and machine-level Registry Run/RunOnce keys using Endpoint Privilege Management.
D3-CVHCredential Vault HardeningHardenT1555.003Enable DPAPI master key audit logging and isolate browser SQLite database files within virtualization-based security containers.

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

Delivery vectors

Persistence mechanisms

SIEM / EDR Ingestion: Need these reference indicators for threat hunting?

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

Tier 1 Primitive Artifact Rule (Fast Triage)

Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.

rule MALWARE_WIN_DANABOT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Danabot"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "danabot" ascii wide nocase
        $s2 = "danabot" ascii wide nocase
        $s3 = "trojan.danabot" ascii wide nocase
        $s4 = "win32/danabot" ascii wide nocase
        $s5 = "backdoor.danabot" ascii wide nocase
        $s6 = "delphi.danabot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Tier 2 Behavioral Context Rule (Process Chains & Sigma)

Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.

title: SystemHelpDesk Detection - Danabot (Banking Trojan) Execution & Triage
id: adeba208-32ce-5d2f-903c-ad1f6a014644
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Danabot malware family. Detects recon staging, certutil file payload staging,
  and web-inject process proxying characteristic of banking trojan initial loaders.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/danabot
- https://malware-families-catalog.systemhelpdesk.com/defensive/banking-trojan-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.banking-trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1056_001
- attack.t1113
- attack.t1071_001
- attack.t1547_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \svchost.exe
    - \explorer.exe
    - \msiexec.exe
    - \certutil.exe
    CommandLine|contains:
    - -urlcache
    - -split -f
    - ipconfig /all
    - route print
    - netstat -ano
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

Tier 3 Attribution Fingerprint Rule (High Fidelity)

Deep signature matching distinctive operational fingerprints and payload characteristics.

rule MALWARE_WIN_DANABOT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Danabot tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "danabot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}
SOC & SIEM Rule Downloads: ⬇ Download YARA Rule (.yar) ⬇ Download Sigma Rule (YAML) ⬇ Download Sigma Rule (JSON) ⚙ Threat Profile API (JSON)

References & External Analysis

Frequently Asked Questions

What is DanaBot and who operates it?

DanaBot is a modular banking trojan authored in Delphi, operated as a cybercrime Malware-as-a-Service affiliate network since May 2018. It is associated with high-profile threat actor groups such as TA505 and TA511.

How does DanaBot use Bitmessage for C2 resilience?

DanaBot integrates the decentralized Bitmessage P2P messaging protocol as an emergency fallback communication channel. If primary C2 servers are seized or blacklisted, the bot receives new C2 IP addresses through broadcast Bitmessage channels.

What modules make up the DanaBot framework?

DanaBot dynamically downloads distinct DLL modules: a web-inject module for Man-in-the-Browser banking theft, a reverse SOCKS proxy module, a VNC screen-control module, a credential stealer module, and a system discovery reconnaissance module.

How is DanaBot distributed to victims?

DanaBot spreads through massive malspam campaigns delivering malicious Microsoft Office documents exploiting CVE-2017-11882 or CVE-2021-40444, and through malvertising campaigns on search engines tricking users into downloading fake software.

What credentials does DanaBot target for theft?

DanaBot targets stored passwords and session cookies from Chromium and Gecko-based browsers, email clients (Outlook, Thunderbird), FTP credentials (FileZilla), and desktop cryptocurrency wallets.

How can network defenders detect DanaBot communication?

Defenders should inspect network perimeter logs for high-frequency binary communications over non-standard TCP ports, identify Bitmessage protocol traffic, and deploy YARA signatures detecting DanaBot's Delphi loader strings.

How does DanaBot utilize a modular architecture written in Delphi to distribute banking injects and stealers?

DanaBot is built in Embarcadero Delphi with a modular multi-stage design. The initial downloader establishes persistence and performs environment discovery before requesting specialized sub-modules from the C2 server. These include a VNC module for real-time remote desktop control, a sniffer module for intercepting network packets, an infostealer module for browser credentials, and a web inject engine for injecting fraudulent forms into financial banking sessions.

What DNS-over-HTTPS (DoH) and Tor proxy features does DanaBot integrate to resist C2 infrastructure takedowns?

To prevent law enforcement and DNS sinkholing operations from disrupting its botnet, DanaBot incorporates DNS-over-HTTPS (DoH) querying via Cloudflare and Google public DNS resolvers to securely fetch updated C2 IP addresses. In addition, newer DanaBot builds embed a lightweight Tor proxy client, enabling the malware to route administrative traffic directly to hidden .onion C2 services if clear-web endpoints are seized.

How do I remove Danabot from Windows?

Manual removal of Danabot is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

What are the main symptoms of a Danabot infection?

Symptoms of Danabot can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Protect Your Network Against Banking_Trojans

Want to prevent Danabot and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection for Businesses.

📣 Threat Intel Correction or Update?

Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.

Need help with an active incident? Published by the SystemHelpdesk threat intelligence team.

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/danabot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.