{
  "family": "danabot",
  "sample_count": 32,
  "category": "ransomware",
  "description": "Trojan:Win32/Danabot is a highly sophisticated, massively prevalent banking trojan and Initial Access Broker (IAB) framework written entirely in Delphi. First discovered in 2018, Danabot operates on a modular Architecture-as-a-Service model, allowing various cybercriminal syndicates to purchase access to the botnet and customize it for web injects (banking fraud), credential theft, or deploying secondary payloads like ransomware.<br><br><b>Understanding Danabot</b><br>To the victim, a Danabot infection is silent until their bank accounts are drained or ransomware encrypts the network. For a security analyst, Danabot is a formidable, multi-layered threat. It is distinguished by its use of the Delphi programming language (which many modern security tools struggle to analyze as effectively as C++) and its highly modular structure. The initial infection is just a 'loader'; the actual malicious capabilities are downloaded as heavily encrypted plugins on the fly.<br><br><b>Execution and Delphi Modularity</b><br>Danabot is primarily distributed via massive malspam campaigns (often using weaponized Office macros or fake invoices) (`T1566.001`). Upon execution, the loader establishes persistence (`T1547.001`) and contacts its C2 infrastructure using an encrypted, custom binary protocol over TCP port 443. It then downloads specialized plugins: a VNC module for remote control (`T1021.001`), a Sniffer module to intercept web traffic (`T1056.004`), and a WebInject module (`T1111`) that modifies banking websites in real-time to steal 2FA tokens and passwords. Danabot frequently utilizes complex Process Hollowing (`T1055.012`) to hide these modules inside legitimate Windows processes.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from severe financial fraud to total enterprise compromise (if used to drop ransomware). EDR platforms must look for anomalous child processes (Process Hollowing) and the presence of unrecognized Delphi-compiled binaries in `%AppData%`. Network analysts should hunt for the distinctive, custom binary protocol over port 443 (which is not standard TLS/SSL, despite the port) communicating with known Danabot infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.004",
    "T1111",
    "T1105",
    "T1021.001",
    "T1055.012"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Credential Access"
    },
    {
      "id": "T1021.001",
      "name": "Remote Services: Remote Desktop Protocol",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt active financial fraud (WebInjects) and prevent the threat actor from pivoting to other machines.",
    "Capture a full forensic memory image of the machine to extract the decrypted Delphi plugins and the custom C2 communication keys.",
    "Assume all credentials entered on the machine (especially banking and corporate VPN credentials) are compromised; initiate immediate password resets.",
    "Audit network logs for non-TLS traffic operating over TCP port 443 to identify the Danabot C2 infrastructure."
  ],
  "what_to_avoid": [
    "Do not leave the machine online while investigating; the attacker has active VNC access and can manually trigger ransomware deployment.",
    "Avoid relying solely on static analysis of the initial loader on disk; the true threat lies in the encrypted plugins downloaded into memory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}