DanaBot
DanaBot is a modular Delphi-based banking Trojan and infostealer operated as a malware-as-a-service platform since at least 2018. It was first reported by Proofpoint in May 2018 in malicious email campaigns targeting users in Australia, and later expanded to campaigns targeting Poland, Italy, Germany, Austria, Ukraine, the United States, Canada, the United Kingdom, Mexico, and other regions. Multiple sources describe it as a banking/stealer malware family with affiliate-driven operations and shared backend infrastructure.
Its capabilities include theft of banking credentials and sessions, browser credentials and cookies, browsing history, device and system information, screenshots, file listings, cryptocurrency wallet information, and data from browsers, mail clients, FTP clients, VPN clients, chat applications, and other software. Reported modules and functions include webinjects, form grabbing, keylogging, screen and video recording, VNC-based remote access, SOCKS/proxying, TOR-based functionality, sniffer capability, FileGrabber behavior, arbitrary payload upload and execution, and full remote access to victim systems. Authorities also stated it could hijack banking sessions and record user activity.
DanaBot uses a multi-stage architecture with a loader, main module, and plugins. It communicates with command-and-control infrastructure over a proprietary binary protocol, commonly over TCP port 443. Earlier versions used plaintext traffic; later versions introduced layered AES and RSA encryption for C2 communications. ESET reported a new encrypted protocol and architectural changes in early 2019, including a loader component registered as a service for persistence. Later reporting described hardcoded C2 IPs, TOR fallback, RSA-protected session keys, and modular command handling. ESET also reported a bug present from 2022 until February 2025 that leaked uninitialized process memory in encrypted packets.
Observed infection vectors include spam emails with malicious attachments or hyperlinks, malicious Word documents with macros, zipped JavaScript attachments, invoice-themed malspam, Hancitor-delivered chains, Brushaloader/BrushaLoader, other malware loaders such as SmokeLoader, DarkGate, and Matanbuchus, fake software and crack sites, malicious Google Ads, fake unclaimed-funds sites, and ClickFix-style social engineering pages. Recent reporting also noted DanaBot delivered by MSI loaders and DLL side-loading chains, including campaigns where a ZIP archive launched DanaBot alongside SectopRAT/ArechClient, and a fake Google Antigravity site whose MSI loader delivered DanaBot.
DanaBot has also been used as a delivery mechanism for additional malware. ESET observed it distributing SystemBC, Rescoms, Ursnif, SmokeLoader, Zloader, Lumma Stealer, RecordBreaker, Latrodectus, and ransomware including LockBit, Buran, Crisis, and a NonRansomware variant. Microsoft reporting cited in the content said DanaBot was used to hand off botnet control to ransomware operators. A separate variant described by U.S. authorities targeted military, diplomatic, government, and law-enforcement-related entities in North America and Europe and sent stolen data to separate servers.
The malware has been associated with financially motivated cybercrime and carding ecosystems rather than a single actor. Proofpoint and ESET described affiliate IDs and centralized administration capabilities, while DOJ and ESET identified alleged Russia-based operators including Aleksandr Stepanov ("JimmBee") and Artem Kalinkin ("Onix"). ESET described JimmBee as a main developer/administrator and Onix as a coadministrator involved in sales. The content also links DanaBot to broader criminal operations and notes its disruption under Operation Endgame. By May 2025, authorities reported the DanaBot network dismantled, with charges against 16 people; DOJ stated the botnet had infected more than 300,000 computers worldwide and caused at least US$50 million in damage.
Targeting has included banks and financial institutions, webmail services, cryptocurrency-related assets, corporate banking software, remote-access tools, individual consumers, companies, and in some reporting, government and military-related entities. In Mexico, DanaBot was reported among the top malware families by victim count and observed infections in 2025.
High-confidence indicators and artifacts mentioned in the content include historical C2 infrastructure such as 84.54.37[.]102, 89.144.25[.]243, 89.144.25[.]104, 178.209.51[.]211, 185.92.222[.]238, 192.71.249[.]51, 149.154.152.64, 149.154.157.220, 158.255.215.31, 178.209.51.227, 37.235.53.232, 45.77.231.138, 45.77.51.69, 45.77.54.180, 45.77.96.198, 95.179.151.252, 23.226.132.92, 23.106.123.249, 108.62.141.152, and 104.144.64.163; TOR/.onion infrastructure including y7zmcwurl6nphcve.onion and 5jjsgjephjcua63go2o5donzw5x4hiwn6wh2dennmyq65pbhk6qflzyd.onion; malware download URLs such as hxxp://45.147.230.58/palata.exe; and detection names including Win32/Spy.Danabot and Win64/Spy.Danabot.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Proofpoint researchers discovered a new banking Trojan, dubbed “DanaBot”, targeting users in Australia via emails containing malicious URLs.
Proofpoint first identified and named DanaBot in May 2018. Initially developed as a banking trojan, DanaBot was also used as an information stealer and loader for follow-on malware.
Proofpoint first identified and named DanaBot in May 2018. Initially developed as a banking trojan, DanaBot was also used as an information stealer and loader for follow-on malware.
Proofpoint first identified and named DanaBot in May 2018. Initially developed as a banking trojan, DanaBot was also used as an information stealer and loader for follow-on malware.
Following DanaBot's debut in May 2018, it quickly gained popularity due to its modular functionality supporting credit card theft, wire fraud, and exfiltration of cryptocurrency-related files.
Proofpoint first identified and named DanaBot in May 2018. Initially developed as a banking trojan, DanaBot was also used as an information stealer and loader for follow-on malware.
Techniques & procedures
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
After being discovered in May 2018 as part of Australia-targeted spam campaigns... appearing in malspam campaigns in Poland, Italy, Germany, Austria and Ukraine, as well as in the United States... At the time of writing, the new version is being distributed under two scenarios: As “updates” delivered to existing DanaBot victims Via malspam in Poland
Execution
3 techniques
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
3 techniques
Stealth
DanaBot includes a significant amount of junk code... DanaBot uses Windows API function hashing and encrypted strings to prevent analysts and automated tools from easily determining the code’s purpose.
Credential Access
4 techniques
Credential Access
Configure various aspects of the malware (e.g., video recording of the screen, keylogging, and webinjects) (Figure 4)
Sniffer plug-in – injects malicious scripts into a victim’s browser, usually while visiting internet banking sites
Discovery
3 techniques
Discovery
0x130 - Upload collected information to C&C server (e.g., screenshot of a victim’s computer; system information) ... 0x132 - Ask C&C server for further commands; there are around 30 available commands typical of backdoors, including launching plugins, gathering detailed system information
Lateral Movement
2 techniques
Lateral Movement
Collection
7 techniques
Collection
Configure various aspects of the malware (e.g., video recording of the screen, keylogging, and webinjects) (Figure 4)
Sniffer plug-in – injects malicious scripts into a victim’s browser, usually while visiting internet banking sites
0x130 - Upload collected information to C&C server (e.g., screenshot of a victim’s computer; system information)
Configure various aspects of the malware (e.g., video recording of the screen, keylogging, and webinjects) (Figure 4)
Command and Control
7 techniques
Command and Control
The fast-evolving, modular Trojan DanaBot has undergone further changes, with the latest version featuring an entirely new communication protocol... The protocol, introduced to DanaBot at the end of January 2019, adds several layers of encryption to DanaBot’s C&C communication.
Table 1: List of modules typically seen... FF1 Sniffer Proxy ... FF5 TOR TOR proxy
TOR plug-in – installs a TOR proxy and enables access to .onion web sites
According to our analysis, the loader component uses the following commands: 0x12D - Download 32/64-bit launcher component 0x12E - Request list of plugins and configuration files 0x12F - Download plugin/configuration files
VNC plug-in – establishes a connection to a victim’s computer and remotely controls it
In August 2018, the attackers started using the TOR plug-in for updating the C&C server list from y7zmcwurl6nphcve.onion.
Following the latest changes, DanaBot uses the AES and RSA encryption algorithms in its C&C communication. The new communication protocol is complicated, with several encryption layers being used... without access to the corresponding RSA keys, it is impossible to decode sent or received packets.
IOCs tracked for this family
137 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as related loader malware used to drop bundled payloads including Xworm in campaigns associated with Lumma delivery.
Financial malware active in Mexico and one of the leading malware families by victims and observed infections in 2025.
The disruption is the latest phase of Operation Endgame, which previously disrupted other malware families, such as DanaBot, Bumblebee, Rhadamanthys, VenomRAT, Elysium, and SmokeLoader.
Malware family mentioned as a previously disrupted cybercriminal operation and as a MaaS ecosystem where affiliates can rent C&C infrastructure as a service.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.