ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool DanaBot

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: DanaBot

NamesDanaBot
CategoryMalware
TypeBanking trojan, Keylogger, Credential stealer, Info stealer
Description(Fortinet) It is a modular banking Trojan that has been historically linked to combining operations with other malware operators, such as those behind Gootkit. Other modules associated with DanaBot include remote desktop through VNC, information stealing, and keylogging. While it appears that this recent attack may be looking to establish a foothold in the network, the reasons behind this are currently unknown.
Information<https://www.fortinet.com/blog/threat-research/breakdown-of-a-targeted-danabot-attack.html>
<https://0ffset.wordpress.com/2018/06/05/post-0x08-analyzing-danabot-downloader/>
<https://www.proofpoint.com/us/threat-insight/post/danabot-gains-popularity-and-targets-us-organizations-large-campaigns>
<https://asert.arbornetworks.com/danabots-travels-a-global-perspective/>
<https://www.welivesecurity.com/2018/09/21/danabot-targeting-europe-adds-new-features/>
<https://www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0>
<https://www.proofpoint.com/us/threat-insight/post/danabot-control-panel-revealed>
<https://www.trustwave.com/Resources/SpiderLabs-Blog/DanaBot-Riding-Fake-MYOB-Invoice-Emails/>
<https://www.welivesecurity.com/2018/12/06/danabot-evolves-beyond-banking-trojan-new-spam/>
<https://www.welivesecurity.com/2019/02/07/danabot-updated-new-cc-communication/>
<https://blog.yoroi.company/research/dissecting-the-danabot-paylaod-targeting-italy/>
<https://www.proofpoint.com/us/blog/threat-insight/new-year-new-version-danabot>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:DanaBot>

Last change to this tool card: 18 April 2021

Download this tool card in JSON format

All groups using tool DanaBot

ChangedNameCountryObserved

Other groups

 Scully Spider, TA547[Unknown]2017-Sep 2019 

1 group listed (0 APT, 1 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key