DanaBot is a Malware-as-a-Service platform active since 2018, known for operating under an affiliate model facilitating banking fraud and credential theft. A memory leak vulnerability named DanaBleed in DanaBot’s C2 server, discovered in 2022, exposed sensitive internal data until the infrastructure was dismantled in 2025 under Operation Endgame. #DanaBot #DanaBleed #OperationEndgame
Keypoints
- DanaBot operates as a Malware-as-a-Service platform since 2018, targeting banking fraud, credential theft, and espionage.
- A programming error introduced in June 2022 (version 2380) caused a memory leak vulnerability in the DanaBot command and control (C2) server, named DanaBleed.
- The DanaBleed memory leak exposed sensitive data including threat actor usernames, IP addresses, backend server details, malware versions, private cryptographic keys, and victim credentials.
- This memory leak persisted for nearly three years until early 2025, allowing researchers unique insight into DanaBot’s internal operations.
- In May 2025, law enforcement dismantled DanaBot’s infrastructure and indicted 16 affiliated individuals as part of Operation Endgame.
- DanaBot’s updated C2 protocol in 2022 mistakenly added uninitialized memory padding, causing leakage of up to 1,792 bytes per response.
- Zscaler’s cloud security platform detects DanaBot-related activity with specific threat names including Win32.Downloader.Danabot and Win32.Banker.Danabot.
MITRE Techniques
- [T1059] Command and Scripting Interpreter – DanaBot uses custom command and control (C2) protocol to generate, encrypt, and send commands to infected victims. (‘Generate command data (e.g. key exchange, system information beacon, configuration file download, additional payload download, new C2 information, etc.)’)
- [T1021] Remote Services – DanaBot’s C2 infrastructure allowed remote access to victim systems and enabled payload downloads. (‘additional payload download’)
- [T1005] Data from Local System – Extracted victim credentials and exfiltrated information from infected hosts, visible in leaked memory.
- [T1071] Application Layer Protocol – DanaBot’s custom binary C2 protocol handled command and data exchanges between the malware and C2 server.
- [T1552] Unsecured Credentials – Private cryptographic keys and victim credentials were exposed due to the memory leak vulnerability DanaBleed.
Indicators of Compromise
- [File Hash] DanaBot main components – 3ce09a0cc03dcf3016c21979b10bc3bfc61a7ba3f582e2838a78f0ccd3556555 (version 2380), ae5eaeb93764bf4ac7abafeb7082a14682c10a15d825d3b76128f63e0aa6ceb9 (version 4006)
- [Malware Names] Detection by Zscaler – Win32.Downloader.Danabot, Win32.Banker.Danabot
Views: 44