1. Home
  2. Software
  3. DanBot

DanBot

DanBot is a first-stage remote access Trojan written in C# that has been used by HEXANE since at least 2018.[1]

ID: S1014
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 03 June 2022
Last Modified: 11 April 2024
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

DanBot can use HTTP in C2 communication.[1]
.004 Application Layer Protocol: DNS

DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications.[1]
Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

DanBot has the ability to execute arbitrary commands via cmd.exe.[1][2]
.005 Command and Scripting Interpreter: Visual Basic

DanBot can use a VBA macro embedded in an Excel file to drop the payload.[1]
Enterprise T1005 Data from Local System

DanBot can upload files from compromised hosts.[1]
Enterprise T1140 Deobfuscate/Decode Files or Information

DanBot can use a VBA macro to decode its payload prior to installation and execution.[1]
Enterprise T1070 .004 Indicator Removal: File Deletion

DanBot can delete its configuration file after installation.[2]
Enterprise T1105 Ingress Tool Transfer

DanBot can download additional files to a targeted system.[1]
Enterprise T1036 .005 Masquerading: Match Legitimate Name or Location

DanBot files have been named UltraVNC.exe and WINVNC.exe to appear as legitimate VNC tools.[2]
Enterprise T1027 .013 Obfuscated Files or Information: Encrypted/Encoded File

DanBot can Base64 encode its payload.[1]
Enterprise T1566 .001 Phishing: Spearphishing Attachment

DanBot has been distributed within a malicious Excel attachment via spearphishing emails.[1]

Enterprise T1021 .005 Remote Services: VNC

DanBot can use VNC for remote access to targeted systems.[2]
Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

DanBot can use a scheduled task for installation.[1]
Enterprise T1204 .002 User Execution: Malicious File

DanBot has relied on victims' opening a malicious file for initial execution.[1][2]

Groups That Use This Software

ID Name References
G1001 HEXANE

[1]

References

  1. SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19
  1. ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.