Operation Endgame 2.0: DanaBusted

This report provides a technical analysis of DanaBot, a Malware-as-a-Service banking and info-stealing trojan with a loader and main module, modular capability set (keylogger, form/file/browser stealer, SOCKS proxy, remote desktop, web injects, screenshot/video capture, and second-stage payload delivery), custom encrypted TCP protocol, multiple persistence mechanisms, active development (many builds through 2025), and distribution via affiliates—used to deploy additional malware including RATs and ransomware.