DanBot
Description
(SecureWorks) A first-stage remote access trojan (RAT) that uses DNS and HTTP-based communication mechanisms and provides basic remote access capability, including the abilities to execute arbitrary commands via cmd.exe and to upload and download files.
DanBot is written in C# using .NET Framework 2.0 and provides basic remote access capabilities. The DNS channel of DanBot’s C2 protocol uses both IPv4 A records and IPv6 AAAA records for communication. The HTTP channel has evolved slightly since the early 2018 samples but retains common elements throughout.
Names
| Name |
|---|
| DanBot |
Category
Malware
Type
- Backdoor
Information
Mitre Attack
Malpedia
Alienvault Otx
Other Information
Uuid
b730233d-5e3f-4046-af2d-9773b8258a50
Last Card Change
2022-12-30