{ "family": "danabot", "sample_count": 32, "category": "banking_trojan", "description": "DanaBot is a sophisticated modular banking trojan, stealer, and loader platform first identified in May 2018 by Proofpoint security researchers. Authored in Embarcadero Delphi, DanaBot is operated under an affiliate-driven Malware-as-a-Service (MaaS) distribution model by Russian-speaking cybercrime groups closely associated with threat actors TA505 and TA511. DanaBot is distributed primarily via high-volume malicious spam (malspam) campaigns mimicking urgent accounting invoices, utility notices, and postal tracking receipts. These emails deliver weaponized Microsoft Office attachments exploiting Equation Editor memory corruption (CVE-2017-11882) or MSHTML remote code execution (CVE-2021-40444), as well as Google Search ad clicks leading to malicious software installers. The architecture of DanaBot is built around a compact primary loader and a suite of dynamically downloaded secondary DLL modules. The loader establishes encrypted communications with C2 nodes over custom binary protocols wrapped in AES and XOR encryption. Uniquely, DanaBot implements a resilient decentralized fallback communication layer utilizing the Bitmessage peer-to-peer network and Tor hidden service routing nodes to receive updated C2 IP addresses in case primary infrastructure is seized. Its operational modules include a browser web-inject module that hooks Chrome, Firefox, and Edge to execute Man-in-the-Browser (MitB) financial diversion; a reverse SOCKS proxy module allowing attackers to funnel unauthorized banking transactions through the victim's residential IP; a custom VNC module for live desktop control; and an aggressive credential-stealing module that extracts passwords, browser cookies, and cryptocurrency wallets from over 50 applications.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "DanaBot", "Trojan.DanaBot", "Win32/DanaBot", "Backdoor.DanaBot", "Delphi.DanaBot" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is DanaBot and who operates it?", "acceptedAnswer": { "@type": "Answer", "text": "DanaBot is a modular banking trojan authored in Delphi, operated as a cybercrime Malware-as-a-Service affiliate network since May 2018. It is associated with high-profile threat actor groups such as TA505 and TA511." } }, { "@type": "Question", "name": "How does DanaBot use Bitmessage for C2 resilience?", "acceptedAnswer": { "@type": "Answer", "text": "DanaBot integrates the decentralized Bitmessage P2P messaging protocol as an emergency fallback communication channel. If primary C2 servers are seized or blacklisted, the bot receives new C2 IP addresses through broadcast Bitmessage channels." } }, { "@type": "Question", "name": "What modules make up the DanaBot framework?", "acceptedAnswer": { "@type": "Answer", "text": "DanaBot dynamically downloads distinct DLL modules: a web-inject module for Man-in-the-Browser banking theft, a reverse SOCKS proxy module, a VNC screen-control module, a credential stealer module, and a system discovery reconnaissance module." } }, { "@type": "Question", "name": "How is DanaBot distributed to victims?", "acceptedAnswer": { "@type": "Answer", "text": "DanaBot spreads through massive malspam campaigns delivering malicious Microsoft Office documents exploiting CVE-2017-11882 or CVE-2021-40444, and through malvertising campaigns on search engines tricking users into downloading fake software." } }, { "@type": "Question", "name": "What credentials does DanaBot target for theft?", "acceptedAnswer": { "@type": "Answer", "text": "DanaBot targets stored passwords and session cookies from Chromium and Gecko-based browsers, email clients (Outlook, Thunderbird), FTP credentials (FileZilla), and desktop cryptocurrency wallets." } }, { "@type": "Question", "name": "How can network defenders detect DanaBot communication?", "acceptedAnswer": { "@type": "Answer", "text": "Defenders should inspect network perimeter logs for high-frequency binary communications over non-standard TCP ports, identify Bitmessage protocol traffic, and deploy YARA signatures detecting DanaBot's Delphi loader strings." } }, { "@type": "Question", "name": "How does DanaBot utilize a modular architecture written in Delphi to distribute banking injects and stealers?", "acceptedAnswer": { "@type": "Answer", "text": "DanaBot is built in Embarcadero Delphi with a modular multi-stage design. The initial downloader establishes persistence and performs environment discovery before requesting specialized sub-modules from the C2 server. These include a VNC module for real-time remote desktop control, a sniffer module for intercepting network packets, an infostealer module for browser credentials, and a web inject engine for injecting fraudulent forms into financial banking sessions." } }, { "@type": "Question", "name": "What DNS-over-HTTPS (DoH) and Tor proxy features does DanaBot integrate to resist C2 infrastructure takedowns?", "acceptedAnswer": { "@type": "Answer", "text": "To prevent law enforcement and DNS sinkholing operations from disrupting its botnet, DanaBot incorporates DNS-over-HTTPS (DoH) querying via Cloudflare and Google public DNS resolvers to securely fetch updated C2 IP addresses. In addition, newer DanaBot builds embed a lightweight Tor proxy client, enabling the malware to route administrative traffic directly to hidden .onion C2 services if clear-web endpoints are seized." } } ], "faq_count": 8, "mitre_attack": [ "T1055", "T1056.001", "T1113", "T1071.001", "T1547.001", "T1572", "T1090.001", "T1555.003", "T1185" ], "cisa_advisory": null, "exploited_cves": [ "CVE-2017-11882", "CVE-2021-40444" ], "last_updated": "2026-10-16", "sources": [ { "name": "Proofpoint Threat Research: DanaBot Takes Aim at Financial Institutions", "url": "https://www.proofpoint.com/us/threat-insight/post/danabot-takes-aim-us-banks" }, { "name": "ESET Research: In-Depth Analysis of DanaBot and its Delphi Modules", "url": "https://www.welivesecurity.com/2018/09/21/danabot-targeting-europe-adds-new-features/" }, { "name": "Zscaler ThreatLabz: DanaBot Evolution and Bitmessage C2 Channel", "url": "https://www.zscaler.com/blogs/security-research/danabot-updated-modular-stealer-banking-trojan" }, { "name": "Trend Micro: Modular Banking Trojan DanaBot Technical Deep Dive", "url": "https://www.trendmicro.com/en_us/research/19/f/danabot-modular-banking-trojan-analyzed.html" } ], "iocs": { "file_hashes": [ "70b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf2", "d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70", "c87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028dd" ], "delivery": [ "Large-scale malspam campaigns distributing weaponized Word/Excel attachments (CVE-2017-11882, CVE-2021-40444)", "Search engine malvertising campaigns leading to trojanized application installers", "Encrypted multi-stage ZIP and ISO container downloads staging Delphi binaries" ], "persistence": [ "Windows Service creation with randomized service names and descriptions", "Registry Run key entries in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "DLL side-loading via legitimate system binaries in %PROGRAMDATA%" ] }, "lineage": { "derived_from": [], "variants": [ "danabot_delphi", "danabot_bitmessage_c2", "danabot_v2020" ] }, "ecosystem": [ "windows", "windows_pe" ], "attack_stage": [ "initial_access", "execution", "persistence", "defense_evasion", "credential_access", "discovery", "collection", "command_and_control", "exfiltration" ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }