Ursnif

First seen

2007-01-01 00:00:00

Malware type

credential-stealer, trojan, spyware, backdoor

Family

Malware family

Operating systems

windows

Related IoCs

1326 (1076 malicious)

Last IoC activity

2026-10-18 03:21:23

Profile updated

2026-07-07 14:58:54

Targeted industries: financial-services healthcare-and-pharmaceutical retail-and-hospitality

Context

Ursnif is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, Spearphishing Attachments, and malicious links. Ursnif is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.

Recent IoC activity

1,076 malicious indicators in Maltiverse are attributed to Ursnif (S0386). The 20 most recently updated:

Detection coverage

• 5 YARA rules
• 682 Sigma rules

Malware & tools used

• Registry Run Keys / Startup Folder (attack-pattern)
• Ingress Tool Transfer (attack-pattern)
• Encrypted/Encoded File (attack-pattern)
• Multi-hop Proxy (attack-pattern)
• Local Data Staging (attack-pattern)
• Native API (attack-pattern)
• Time Based Checks (attack-pattern)
• Component Object Model (attack-pattern)
• Credential API Hooking (attack-pattern)
• Process Discovery (attack-pattern)
• Exfiltration Over C2 Channel (attack-pattern)
• Data Encoding (attack-pattern)
• Thread Local Storage (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• Match Legitimate Resource Name or Location (attack-pattern)
• Data from Local System (attack-pattern)
• Command Obfuscation (attack-pattern)
• Screen Capture (attack-pattern)
• Windows Service (attack-pattern)
• PowerShell (attack-pattern)
• Web Protocols (attack-pattern)
• File Deletion (attack-pattern)
• Query Registry (attack-pattern)
• Modify Registry (attack-pattern)
• Domain Generation Algorithms (attack-pattern)

Used by threat actors

• Zloader & Ursnif Affiliate Campaign 2020-22 (campaign)
• TA551 (threat-actor)

Detection rules

• CAPE_Ursnif (yara-rule)
• SEKOIA_Ursnif_Ldr4 (yara-rule)
• CAPE_Ursnifv3 (yara-rule)
• SEKOIA_Ursnif (yara-rule)
• EMBEERESEARCH_Win_Ursnif_Patterns_Oct_2022 (yara-rule)

Reports & references

• Mandiant — Ursnif Variant Malicious Tls Callback Technique (report)
• MITRE ATT&CK — S0386 (report)
• web.archive.org — Ursnif The Multifaceted Malware (report)
• cyber.nj.gov — Ursnif (report)
• proofpoint.com — Ursnif Variant Dreambot Adds Tor Functionality (report)

External references

• mitre-attack — S0386
• Gozi-ISFB
• Ursnif
• Dreambot
• PE_URSNIF
• TrendMicro Ursnif Mar 2015
• NJCCIC Ursnif Sept 2016
• ProofPoint Ursnif Aug 2016
• FireEye Ursnif Nov 2017
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy