MITRE ATT&CKsoftware (malware)
S0386 Ursnif
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- Gozi-ISFB, PE_URSNIF, Dreambot
- Version
- 1.5
- Created
- 2019-06-04
Description
Ursnif is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, Spearphishing Attachments, and malicious links. Ursnif is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.
Related
Uses · MITRE ATT&CK (35)
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.010 Command Obfuscation sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1074.001 Local Data Staging sub-technique
- T1564.003 Hidden Window sub-technique
- T1568.002 Domain Generation Algorithms sub-technique
- T1059.001 PowerShell sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.003 Time Based Checks sub-technique
- T1559.001 Component Object Model sub-technique
- T1056.004 Credential API Hooking sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1055.005 Thread Local Storage sub-technique
- T1055.012 Process Hollowing sub-technique
- T1185 Browser Session Hijacking technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1007 System Service Discovery technique
- T1012 Query Registry technique
- T1041 Exfiltration Over C2 Channel technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
- T1080 Taint Shared Content technique
- T1082 System Information Discovery technique
- T1090 Proxy technique
- T1091 Replication Through Removable Media technique
Referenced by MITRE ATT&CK · uses (1)
- G0127 TA551 group
References
- https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992 TrendMicro Ursnif Mar 2015
- https://www.cyber.nj.gov/threat-landscape/malware/trojans/ursnif NJCCIC Ursnif Sept 2016
- https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality ProofPoint Ursnif Aug 2016
- https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html FireEye Ursnif Nov 2017