Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 7 actors

DanaBot

DanaBot is a modular Delphi-based banking Trojan and infostealer operated as a malware-as-a-service platform since at least 2018. It was first reported by Proofpoint in May 2018 in malicious email campaigns targeting users in Australia, and later expanded to campaigns targeting Poland, Italy, Germany, Austria, Ukraine, the United States, Canada, the United Kingdom, Mexico, and other regions. Multiple sources describe it as a banking/stealer malware family with affiliate-driven operations and shared backend infrastructure.

Its capabilities include theft of banking credentials and sessions, browser credentials and cookies, browsing history, device and system information, screenshots, file listings, cryptocurrency wallet information, and data from browsers, mail clients, FTP clients, VPN clients, chat applications, and other software. Reported modules and functions include webinjects, form grabbing, keylogging, screen and video recording, VNC-based remote access, SOCKS/proxying, TOR-based functionality, sniffer capability, FileGrabber behavior, arbitrary payload upload and execution, and full remote access to victim systems. Authorities also stated it could hijack banking sessions and record user activity.

DanaBot uses a multi-stage architecture with a loader, main module, and plugins. It communicates with command-and-control infrastructure over a proprietary binary protocol, commonly over TCP port 443. Earlier versions used plaintext traffic; later versions introduced layered AES and RSA encryption for C2 communications. ESET reported a new encrypted protocol and architectural changes in early 2019, including a loader component registered as a service for persistence. Later reporting described hardcoded C2 IPs, TOR fallback, RSA-protected session keys, and modular command handling. ESET also reported a bug present from 2022 until February 2025 that leaked uninitialized process memory in encrypted packets.

Observed infection vectors include spam emails with malicious attachments or hyperlinks, malicious Word documents with macros, zipped JavaScript attachments, invoice-themed malspam, Hancitor-delivered chains, Brushaloader/BrushaLoader, other malware loaders such as SmokeLoader, DarkGate, and Matanbuchus, fake software and crack sites, malicious Google Ads, fake unclaimed-funds sites, and ClickFix-style social engineering pages. Recent reporting also noted DanaBot delivered by MSI loaders and DLL side-loading chains, including campaigns where a ZIP archive launched DanaBot alongside SectopRAT/ArechClient, and a fake Google Antigravity site whose MSI loader delivered DanaBot.

DanaBot has also been used as a delivery mechanism for additional malware. ESET observed it distributing SystemBC, Rescoms, Ursnif, SmokeLoader, Zloader, Lumma Stealer, RecordBreaker, Latrodectus, and ransomware including LockBit, Buran, Crisis, and a NonRansomware variant. Microsoft reporting cited in the content said DanaBot was used to hand off botnet control to ransomware operators. A separate variant described by U.S. authorities targeted military, diplomatic, government, and law-enforcement-related entities in North America and Europe and sent stolen data to separate servers.

The malware has been associated with financially motivated cybercrime and carding ecosystems rather than a single actor. Proofpoint and ESET described affiliate IDs and centralized administration capabilities, while DOJ and ESET identified alleged Russia-based operators including Aleksandr Stepanov ("JimmBee") and Artem Kalinkin ("Onix"). ESET described JimmBee as a main developer/administrator and Onix as a coadministrator involved in sales. The content also links DanaBot to broader criminal operations and notes its disruption under Operation Endgame. By May 2025, authorities reported the DanaBot network dismantled, with charges against 16 people; DOJ stated the botnet had infected more than 300,000 computers worldwide and caused at least US$50 million in damage.

Targeting has included banks and financial institutions, webmail services, cryptocurrency-related assets, corporate banking software, remote-access tools, individual consumers, companies, and in some reporting, government and military-related entities. In Mexico, DanaBot was reported among the top malware families by victim count and observed infections in 2025.

High-confidence indicators and artifacts mentioned in the content include historical C2 infrastructure such as 84.54.37[.]102, 89.144.25[.]243, 89.144.25[.]104, 178.209.51[.]211, 185.92.222[.]238, 192.71.249[.]51, 149.154.152.64, 149.154.157.220, 158.255.215.31, 178.209.51.227, 37.235.53.232, 45.77.231.138, 45.77.51.69, 45.77.54.180, 45.77.96.198, 95.179.151.252, 23.226.132.92, 23.106.123.249, 108.62.141.152, and 104.144.64.163; TOR/.onion infrastructure including y7zmcwurl6nphcve.onion and 5jjsgjephjcua63go2o5donzw5x4hiwn6wh2dennmyq65pbhk6qflzyd.onion; malware download URLs such as hxxp://45.147.230.58/palata.exe; and detection names including Win32/Spy.Danabot and Win64/Spy.Danabot.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TA547

Proofpoint researchers discovered a new banking Trojan, dubbed “DanaBot”, targeting users in Australia via emails containing malicious URLs.

via proofpoint threat insight blogproofpoint.com
TA578

Proofpoint first identified and named DanaBot in May 2018. Initially developed as a banking trojan, DanaBot was also used as an information stealer and loader for follow-on malware.

via proofpointproofpoint.com
TA544

Proofpoint first identified and named DanaBot in May 2018. Initially developed as a banking trojan, DanaBot was also used as an information stealer and loader for follow-on malware.

via proofpointproofpoint.com
TA571

Proofpoint first identified and named DanaBot in May 2018. Initially developed as a banking trojan, DanaBot was also used as an information stealer and loader for follow-on malware.

via proofpointproofpoint.com
SCULLY SPIDER

Following DanaBot's debut in May 2018, it quickly gained popularity due to its modular functionality supporting credit card theft, wire fraud, and exfiltration of cryptocurrency-related files.

via crowdstrike blogcrowdstrike.com
TA564

Proofpoint first identified and named DanaBot in May 2018. Initially developed as a banking trojan, DanaBot was also used as an information stealer and loader for follow-on malware.

via proofpointproofpoint.com
MITRE ATT&CK

Techniques & procedures

32 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques
T1566PhishingEvidence1

After being discovered in May 2018 as part of Australia-targeted spam campaigns... appearing in malspam campaigns in Poland, Italy, Germany, Austria and Ukraine, as well as in the United States... At the time of writing, the new version is being distributed under two scenarios: As “updates” delivered to existing DanaBot victims Via malspam in Poland

T1566.001Spearphishing AttachmentEvidence1

To compromise their victims, the attackers behind the Poland-targeted campaign use emails posing as invoices from various companies.

T1566.002Spearphishing LinkEvidence2

These sites impersonate AI tools or platforms. Recently registered and mimicking the branding of the targeted companies, these websites are empty shells whose sole purpose is to deliver payloads via ErrTraffic.

Execution

3 techniques
T1059Command and Scripting InterpreterEvidence1

Operate on infected devices (e.g., search for files, download files, execute commands, take a screenshot, and open a VNC session) (Figure 6)

T1059.001PowerShellEvidence2

PowerShell command lines for downloading the malicious payload.

T1059.005Visual BasicEvidence1

The campaign makes use of a combination of PowerShell and VBS scripts widely known as Brushaloader.

Persistence

2 techniques
T1543.003Windows ServiceEvidence1

The latest version shifts both these responsibilities to a new loader component, which is used to download all plugins along with the main module. Persistence is achieved by registering the loader component as a service.

T1547.009Shortcut ModificationEvidence1

Persistence is maintained by creating an LNK file that executes the main component in the user’s Startup directory.

Privilege Escalation

2 techniques
T1543.003Windows ServiceEvidence1

The latest version shifts both these responsibilities to a new loader component, which is used to download all plugins along with the main module. Persistence is achieved by registering the loader component as a service.

T1547.009Shortcut ModificationEvidence1

Persistence is maintained by creating an LNK file that executes the main component in the user’s Startup directory.

Stealth

3 techniques
T1027Obfuscated Files or InformationEvidence1

DanaBot includes a significant amount of junk code... DanaBot uses Windows API function hashing and encrypted strings to prevent analysts and automated tools from easily determining the code’s purpose.

T1036MasqueradingEvidence1

The malicious domain chatgpt-web[.]vip mimics the official ChatGPT landing page

T1497.001System ChecksEvidence1

The software and websites targeted in these new campaigns are listed at the end of this article.

Credential Access

4 techniques
T1056.001KeyloggingEvidence2

Configure various aspects of the malware (e.g., video recording of the screen, keylogging, and webinjects) (Figure 4)

T1056.003Web Portal CaptureEvidence2

Sniffer plug-in – injects malicious scripts into a victim’s browser, usually while visiting internet banking sites

T1539Steal Web Session CookieEvidence1

Files typically seen sent Filename Comments Cookies.txt Stored web browser cookies

T1555Credentials from Password StoresEvidence2

Stealer plug-in – harvests passwords from a wide variety of applications (browsers, FTP clients, VPN clients, chat and email programs, poker programs etc.)

Discovery

3 techniques
T1082System Information DiscoveryEvidence2

0x130 - Upload collected information to C&C server (e.g., screenshot of a victim’s computer; system information) ... 0x132 - Ask C&C server for further commands; there are around 30 available commands typical of backdoors, including launching plugins, gathering detailed system information

T1083File and Directory DiscoveryEvidence2

0x131 - Upload collected information to C&C server (e.g., list of files on the victim’s hard disk)

T1497.001System ChecksEvidence1

The software and websites targeted in these new campaigns are listed at the end of this article.

Lateral Movement

2 techniques
T1021.001Remote Desktop ProtocolEvidence1

Finally, in the beginning of September 2018, an RDP plug-in was added to DanaBot. It is based on the open-source project RDPWrap that provides Remote Desktop Protocol connections to Windows machines that normally do not support it.

T1021.005VNCEvidence1

VNC plug-in – establishes a connection to a victim’s computer and remotely controls it

Collection

7 techniques
T1005Data from Local SystemEvidence1

Targeted cryptocurrency wallets *\wallet.dat* *\default_wallet*

T1056.001KeyloggingEvidence2

Configure various aspects of the malware (e.g., video recording of the screen, keylogging, and webinjects) (Figure 4)

T1056.003Web Portal CaptureEvidence2

Sniffer plug-in – injects malicious scripts into a victim’s browser, usually while visiting internet banking sites

T1113Screen CaptureEvidence4

0x130 - Upload collected information to C&C server (e.g., screenshot of a victim’s computer; system information)

T1125Video CaptureEvidence1

Configure various aspects of the malware (e.g., video recording of the screen, keylogging, and webinjects) (Figure 4)

T1185Browser Session HijackingEvidence1

Table 2: Configuration files typically seen... PosWtFilter ... List of websites for which to steal requests ... InjectZZ, InjectSW Webinjects ... Zeus-style injects

T1560Archive Collected DataEvidence1

Data can be ZLIB-compressed and AES-256-CBC-encrypted... The decrypted data is optionally ZLIB compressed...

Command and Control

7 techniques
T1071Application Layer ProtocolEvidence3

The fast-evolving, modular Trojan DanaBot has undergone further changes, with the latest version featuring an entirely new communication protocol... The protocol, introduced to DanaBot at the end of January 2019, adds several layers of encryption to DanaBot’s C&C communication.

T1090ProxyEvidence1

Table 1: List of modules typically seen... FF1 Sniffer Proxy ... FF5 TOR TOR proxy

T1090.003Multi-hop ProxyEvidence2

TOR plug-in – installs a TOR proxy and enables access to .onion web sites

T1105Ingress Tool TransferEvidence3

According to our analysis, the loader component uses the following commands: 0x12D - Download 32/64-bit launcher component 0x12E - Request list of plugins and configuration files 0x12F - Download plugin/configuration files

T1219Remote Access ToolsEvidence3

VNC plug-in – establishes a connection to a victim’s computer and remotely controls it

T1568Dynamic ResolutionEvidence1

In August 2018, the attackers started using the TOR plug-in for updating the C&C server list from y7zmcwurl6nphcve.onion.

T1573Encrypted ChannelEvidence2

Following the latest changes, DanaBot uses the AES and RSA encryption algorithms in its C&C communication. The new communication protocol is complicated, with several encryption layers being used... without access to the corresponding RSA keys, it is impossible to decode sent or received packets.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

0x130 - Upload collected information to C&C server (e.g., screenshot of a victim’s computer; system information) 0x131 - Upload collected information to C&C server (e.g., list of files on the victim’s hard disk)

INDICATORS OF COMPROMISE

IOCs tracked for this family

137 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
74 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
52 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
11 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app11 days ago
ip.v4●●●●●●●●●●●●View more in app1 month ago
domain●●●●●●●●●●●●View more in app1 year ago
ip.v4●●●●●●●●●●●●View more in app1 year ago
ip.v4●●●●●●●●●●●●View more in app1 year ago
ip.v4●●●●●●●●●●●●View more in app1 year ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching137

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution7

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping32

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.