สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool DanaBot

Threat Group Cards: A Threat Actor Encyclopedia

Tool: DanaBot

Names	DanaBot
Category	Malware
Type	Banking trojan, Keylogger, Credential stealer, Info stealer
Description	(Fortinet) It is a modular banking Trojan that has been historically linked to combining operations with other malware operators, such as those behind Gootkit. Other modules associated with DanaBot include remote desktop through VNC, information stealing, and keylogging. While it appears that this recent attack may be looking to establish a foothold in the network, the reasons behind this are currently unknown.
Information	<https://www.fortinet.com/blog/threat-research/breakdown-of-a-targeted-danabot-attack.html> <https://0ffset.wordpress.com/2018/06/05/post-0x08-analyzing-danabot-downloader/> <https://www.proofpoint.com/us/threat-insight/post/danabot-gains-popularity-and-targets-us-organizations-large-campaigns> <https://asert.arbornetworks.com/danabots-travels-a-global-perspective/> <https://www.welivesecurity.com/2018/09/21/danabot-targeting-europe-adds-new-features/> <https://www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0> <https://www.proofpoint.com/us/threat-insight/post/danabot-control-panel-revealed> <https://www.trustwave.com/Resources/SpiderLabs-Blog/DanaBot-Riding-Fake-MYOB-Invoice-Emails/> <https://www.welivesecurity.com/2018/12/06/danabot-evolves-beyond-banking-trojan-new-spam/> <https://www.welivesecurity.com/2019/02/07/danabot-updated-new-cc-communication/> <https://blog.yoroi.company/research/dissecting-the-danabot-paylaod-targeting-italy/> <https://www.proofpoint.com/us/blog/threat-insight/new-year-new-version-danabot> <https://www.zscaler.com/blogs/security-research/danableed-danabot-c2-server-memory-leak-bug>
Malpedia	<https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot>
AlienVault OTX	<https://otx.alienvault.com/browse/pulses?q=tag:DanaBot>

Last change to this tool card: 28 June 2025

Download this tool card in JSON format

All groups using tool DanaBot

Changed	Name	Country	Observed
Other groups
	Scully Spider, TA547	[Unknown]	2017-Mar 2024

1 group listed (0 APT, 1 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]