S0386 - Ursnif

Name: S0386 - Ursnif
Creator: Maltiverse
Published: 2023-08-14

Ursnif is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, Spearphishing Attachments, and malicious links. Ursnif is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.

Author: agomez
Created: 2023-08-14 15:22:28
Last updated: 2026-02-07 18:53:08
Downloads: 529005
IPv4 indicators: 11
Hostname indicators: 518
URL indicators: 190
Sample indicators: 351

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

adoring-driscoll.31-214-157-11.plesk.page Hostname

modified 2026-10-17 07:23:24
Gozi (ThreatFox Abuse.ch)

f8a1d78eb7691f90053a5d7ad70588bed4c4a5cdd7bc949c368d8c2bc62f95c4.bin Sample

modified 2026-10-17 05:17:25
Generic Malware (Hybrid-Analysis) · Gozi (MalwareBazaar Abuse.ch)

karolinaherrera.com Hostname

modified 2026-10-17 04:36:25
Deathransom (Maltiverse Threat Observatory) · Downloader.win32.generic (Maltiverse Threat Observatory) · Exploit.minerva (Maltiverse Threat Observatory) · Gozi (Maltiverse Threat Observatory) · Phishing.artifact (Maltiverse Threat Observatory)

tmp1.super-list.ru Hostname

modified 2026-10-17 04:33:19
Gozi (ThreatFox Abuse.ch)

orhtmlcbodyerrorhtml.net Hostname

modified 2026-10-17 03:01:38
Gozi (ThreatFox Abuse.ch)

golang.feel500.at Hostname

modified 2026-10-17 00:38:53
Gozi (ThreatFox Abuse.ch)

nort.calag.at Hostname

modified 2026-10-17 00:36:12
Gozi (ThreatFox Abuse.ch) · Malicious site (Hybrid-Analysis) · Trojan.Script (Hybrid-Analysis) · Threats200220200050 (CronUp Threat Intel) · IOC_03032020 (CronUp Threat Intel)

1f4a6594efb9dbc27a6a871eef0a394b80ddf3e7e653d7870cf09dffee6f4108 Sample

modified 2026-10-16 21:16:49
Ursnif (Cyber Threat Alliance)

28b2f1d62a1101183bd9d3d5de2307dfaf23616a9db72692176eb156fa360590 Sample

modified 2026-10-16 20:42:37
Ursnif (Cyber Threat Alliance)

faf6ec464e9c672fc7c410524053b394b9abe9b1a27fb51f4322c456bd4ec857 Sample

modified 2026-10-16 20:33:49
Ursnif (Cyber Threat Alliance)

line.mbclegacyllc.net Hostname

modified 2026-10-16 16:32:55
Covid19 scam (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition) · Gozi (ThreatFox Abuse.ch)

hfdhdfgrre.ru Hostname

modified 2026-10-16 14:47:11
Gozi (ThreatFox Abuse.ch)

astope.xyz Hostname

modified 2026-10-16 12:36:56
Gozi (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

lolila.net Hostname

modified 2026-10-16 12:36:41
Gozi (ThreatFox Abuse.ch)

go.in100k.at Hostname

modified 2026-10-16 12:33:55
Gozi (ThreatFox Abuse.ch)

news-deck.at Hostname

modified 2026-10-16 08:40:56
Gozi (ThreatFox Abuse.ch) · Gameover-zeus (tunPOT) · Covid19 scam (Cyber Threat Coalition) · Malicious url (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition)

statusline.ru Hostname

modified 2026-10-16 08:40:32
Gozi (ThreatFox Abuse.ch)

nifredao.com Hostname

modified 2026-10-16 08:39:05
Gozi (ThreatFox Abuse.ch)

temniyles.ru Hostname

modified 2026-10-16 08:37:20
Gozi (ThreatFox Abuse.ch)

strengit.xyz Hostname

modified 2026-10-16 06:11:21
Gozi (ThreatFox Abuse.ch) · ISFB (ThreatFox Abuse.ch)

living-start.at Hostname

modified 2026-10-16 04:40:51
Gozi (ThreatFox Abuse.ch) · Gameover-zeus (tunPOT)

ad1.wensa.at Hostname

modified 2026-10-16 04:39:33
Gozi (ThreatFox Abuse.ch) · Malicious site (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · Trojan.Script (Hybrid-Analysis) · TOP AMENAZAS - 19022020 (CronUp Threat Intel)

fishenddog.xyz Hostname

modified 2026-10-16 04:39:26
RM3 (ThreatFox Abuse.ch) · Gozi (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

134b2e1b36acc15c9aa972986ed209fe0c3aababfceb48691e3e266f15bf0a42 Sample

modified 2026-10-15 20:53:37
Ursnif (Cyber Threat Alliance)

perviysneg.ru Hostname

modified 2026-10-15 20:37:46
Gozi (ThreatFox Abuse.ch)

19f0aa168c8238bef6a8154d46d07f12bef42d2e582bfad060546ec00d6b4870 Sample

modified 2026-10-15 17:07:06
Ursnif (Cyber Threat Alliance)

f5794a4a7bf5ac56a8089945da7647ab4b105632154a6b00615cd97bf3cd01eb Sample

modified 2026-10-15 13:52:10
Ursnif (Cyber Threat Alliance)

141.255.161.167 IPv4

modified 2026-10-15 13:02:36
gozi,isfb,papras,ursnif (Maltiverse) · Ursnif (Maltiverse) · Anonymizer (Maltiverse) · ET TOR Known Tor Relay/Router (Not Exit) Node UDP Traffic (Emerging Threats) · Malicious host (Talos Intelligence)