DanBot — Malware Profile

DanBot is a first-stage remote access Trojan written in C# that has been used by HEXANE since at least 2018.

MITRE ATT&CK techniques (14)

• T1005 Data from Local System
• T1021.005 VNC
• T1027.013 Encrypted/Encoded File
• T1036.005 Match Legitimate Resource Name or Location
• T1053.005 Scheduled Task
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1071.004 DNS
• T1105 Ingress Tool Transfer
• T1140 Deobfuscate/Decode Files or Information
• T1204.002 Malicious File
• T1566.001 Spearphishing Attachment

IntelFusions coverage

• OilRig Outer Space and Juicy Mix Campaigns: Solar and Mango C#/.NET Backdoors Target Israeli Organizations with XOR Encryption, Compromised Israeli Websites as C2 2026-02-16

Attributed threat actors

• HEXANE

Read the full analysis on IntelFusions