Danabot

Overview

Trojan:Win32/Danabot is a highly sophisticated, massively prevalent banking trojan and Initial Access Broker (IAB) framework written entirely in Delphi. First discovered in 2018, Danabot operates on a modular Architecture-as-a-Service model, allowing various cybercriminal syndicates to purchase access to the botnet and customize it for web injects (banking fraud), credential theft, or deploying secondary payloads like ransomware.

Understanding Danabot
To the victim, a Danabot infection is silent until their bank accounts are drained or ransomware encrypts the network. For a security analyst, Danabot is a formidable, multi-layered threat. It is distinguished by its use of the Delphi programming language (which many modern security tools struggle to analyze as effectively as C++) and its highly modular structure. The initial infection is just a 'loader'; the actual malicious capabilities are downloaded as heavily encrypted plugins on the fly.

Execution and Delphi Modularity
Danabot is primarily distributed via massive malspam campaigns (often using weaponized Office macros or fake invoices) (`T1566.001`). Upon execution, the loader establishes persistence (`T1547.001`) and contacts its C2 infrastructure using an encrypted, custom binary protocol over TCP port 443. It then downloads specialized plugins: a VNC module for remote control (`T1021.001`), a Sniffer module to intercept web traffic (`T1056.004`), and a WebInject module (`T1111`) that modifies banking websites in real-time to steal 2FA tokens and passwords. Danabot frequently utilizes complex Process Hollowing (`T1055.012`) to hide these modules inside legitimate Windows processes.

Indicators of Compromise & Impact
The impact ranges from severe financial fraud to total enterprise compromise (if used to drop ransomware). EDR platforms must look for anomalous child processes (Process Hollowing) and the presence of unrecognized Delphi-compiled binaries in `%AppData%`. Network analysts should hunt for the distinctive, custom binary protocol over port 443 (which is not standard TLS/SSL, despite the port) communicating with known Danabot infrastructure.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DANABOT {
    meta:
        description = "Detects Danabot (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "danabot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Danabot Activity
id: 0e3263ebcdc7611ae808f82e58353ac5
status: experimental
description: Detects generic indicators of the danabot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*danabot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to halt active financial fraud (WebInjects) and prevent the threat actor from pivoting to other machines.
2. Capture a full forensic memory image of the machine to extract the decrypted Delphi plugins and the custom C2 communication keys.
3. Assume all credentials entered on the machine (especially banking and corporate VPN credentials) are compromised; initiate immediate password resets.
4. Audit network logs for non-TLS traffic operating over TCP port 443 to identify the Danabot C2 infrastructure.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not leave the machine online while investigating; the attacker has active VNC access and can manually trigger ransomware deployment.
2. Avoid relying solely on static analysis of the initial loader on disk; the true threat lies in the encrypted plugins downloaded into memory.

References & External Analysis

• Search "danabot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Tilken
• Oyom
• Cryrar
• Agiala
• Dodiw

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/danabot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.