DanaBotMalware
- danatools
Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on “quality over quantity” in email-based threats.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1110Brute Force
“Shellcode decryption via brute-force key recovery”
- T1684Social Engineering
“…uary 2026, the Huntress Tactical Response team and SOC responded to a hands-on intrusion that began with a ClickFix infection, the social engineering technique that just won't die.”
- T1027.007Dynamic API Resolution
“The list below includes DLL names for dynamic API resolution, User-Agent strings, WQL queries, registry paths, format strings, and EDR process names used for security product detection:”
- T1027.009Embedded Payloads
“These are the only four APIs the shellcode resolves directly, and everything else is handled later by the embedded payloads:”
- T1053.005Scheduled Task
“With AstarionRAT active on the initial endpoint, the operator established persistence via a scheduled task named Application Maintenance, configured to execute Core.exe from C:\ProgramData\2895e798a2579e6\.”
- T1110.004Credential Stuffing
“The distribution across seven consumer residential ISPs spanning three countries is consistent with the use of a credential stuffing tool routed through a residential proxy service.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
ErrTraffic: A Growing ClickFix Malware Distribution Framework“Dynamic analysis via sandbox execution confirmed that this MSI functions as a loader that delivers DanaBot malware.”
-
A New RAT and a Hands-on-Keyboard Intrusion“Over the years, Matanbuchus has been used to deliver a range of follow-on payloads, including Cobalt Strike, QakBot, DanaBot, Rhadamanthys stealer, and NetSupport RAT.”
-
Ten Years of Resilience, Innovation & Community-Driven Defense“…ected millions of computers and have been tracked in the wild by our security researchers at Huntress were disrupted, including Qakbot, DanaBot, Lactrodectus, and Bumblebee.”
Indicators in its reports
named in the reports above- flare[.]ioin 1 report
- chatgpt-web[.]vipin 1 report
- llc-image-ico[.]clickin 1 report
- 96.178.187[.]175in 1 report
- 96.181.156[.]219in 1 report
- 172.59.242[.]93in 1 report
- 68.60.174[.]238in 1 report
- a3f8b2c1d4e5f607…930a1b2c3d4ein 1 report
- be61936de03f3842ee814fd80a10233ain 1 report
- webanalytics-cdn[.]sbsin 1 report
- antigravity[.]studyin 1 report
- defi-xstocks[.]vipin 1 report
- hxxp://binclloudapp[.]com/466943in 1 report
- binclloudapp[.]comin 1 report
- 192.121.23[.]146in 1 report
- sectigoapps[.]comin 1 report
- solidclouaps[.]comin 1 report
- hxxps://marle[.]io/check/updprofile.aspxin 1 report
- marle[.]ioin 1 report
- www.ndibstersoft[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.