Loading malware…
Ursnif, also commonly known as Gozi or Gozi ISFB, is a Windows banking-trojan family with information-stealing, surveillance, and remote-access capabilities. DreamBot is a prominent variant. Originally associated with online banking fraud, Ursnif has also been used as a loader for additional malware. Campaigns have targeted users and organizations internationally, including substantial activity in Italy and Japan, with configurations targeting banking, corporate payment, credit-card, and cryptocurrency services. Storm-0324 and Sangria Tempest, also known as FIN7, have historically been associated with Gozi distribution.
Ursnif steals credentials, browser cookies, email-account information, clipboard contents, browsing history, and files. It can log keystrokes, capture screenshots and screen video, and collect host, application, and process information. Browser injection, web injections, HTTP traffic modification, and session hijacking enable man-in-the-browser attacks against financial services. Some variants support hidden-desktop remote control, allowing operators to interact with applications without visibly disturbing the user's desktop. Stolen information can be packaged into compressed archives and exfiltrated to command-and-control infrastructure.
Distribution includes spear-phishing and mass-mail campaigns, often using invoice or order-confirmation lures. Email-thread hijacking makes malicious messages resemble replies to existing conversations. Infection chains have used macro-enabled Word documents, JavaScript downloaders in ZIP archives, and malicious Windows shortcuts. Ursnif has also been delivered by other downloaders and through malvertising-driven exploit kits, including Stegano and RIG.
Observed variants inject code into Windows processes and browsers, establish persistence through startup configuration, and propagate by copying themselves to network drives and infecting shared files. Evasion techniques include mouse-movement-dependent execution, delayed activity, execution obfuscation, and Heaven's Gate. Command-and-control implementations vary by variant and include encrypted communications, domain generation, and Tor. DreamBot variants have used Serpent-encrypted initial check-ins disguised as ordinary web requests, followed by SSL-protected communications.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trend Micro uncovered a malicious Rich Text Format (RTF) file exploiting CVE-2017-11882 to deliver the spyware Loki (TSPY_LOKI). ... CVE-2017-11882 is a 17-year old memory corruption issue in Microsoft Office ... The flaw resides within Equation Editor (EQNEDT32.EXE) ... A proof-of-concept exploit was released publicly, but this has been fixed by Microsoft’s November Patch Tuesday.
CVE-2016-7255 Classification: 0-Day Basic Description: Memory corruption in NtUserSetWindowLongPtr ... Found in the following Malware samples: Attributed to APT28 (aka Fancy Bear, Sednit). Used later by Ursnif, Dreambot, GandCrab, Cerber, Maze | Used later by Ursnif, Dreambot, GandCrab, Cerber, Maze
CVE-2015-2546 Classification: 1-Day Basic Description: Use-After-Free in xxxSendMessage (tagPOPUPMENU) ... Found in the following Malware samples: Ursnif, Buhtrap | Found in the following Malware samples: Ursnif, Buhtrap
CVE-2017-0001 Classification: 1-Day Basic Description: Use-After-Free in RemoveFontResourceExW ... Found in the following Malware samples: Attributed to Turla. Later used by Ursnif | Found in the following Malware samples: Ursnif, Buhtrap
CVE-2016-0040 Classification: 1-Day Basic Description: Uninitialized kernel pointer in WMIDataDevice IOControl ... Was never exploited as a 0-Day in the wild Found in the following Malware samples: Ursnif | Found in the following Malware samples: Ursnif, Buhtrap
CVE-2016-0165* Classification: 1-Day Basic Description: Use-After-Free in Win32k!xxxMNDestroyHandler ... Found in the following Malware samples: Ursnif | Found in the following Malware samples: Ursnif, Buhtrap
Spelevo Exploit Kitは2つの脆弱性(CVE-2018-8174とCVE-2018-15982)を悪用することが報告されていますが、PseudoGateによる攻撃ではCVE-2018-15982のみが観測されています。CVE-2018-15982はAdobe Flash PlayerのRCEの脆弱性です。
the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office (CVE-2017-8570) and another that uses a malicious macro.
Using the known Internet Explorer vulnerability CVE-2016-0162, the encoded script attempts to verify that it is not being run in a monitored environment such as a malware analyst’s machine.
The landing page loads a Flash file that is able to exploit three different vulnerabilities (CVE-2015-8651, CVE-2016-1019, CVE-2016-4117), depending on the version of Flash found on the victim's system.
The landing page loads a Flash file that is able to exploit three different vulnerabilities (CVE-2015-8651, CVE-2016-1019, CVE-2016-4117), depending on the version of Flash found on the victim's system.
The landing page loads a Flash file that is able to exploit three different vulnerabilities (CVE-2015-8651, CVE-2016-1019, CVE-2016-4117), depending on the version of Flash found on the victim's system.
19 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The threat actors Sangria Tempest and Storm-0324 previously had been associated with the distribution of the Gozi InfoStealer.”
“The threat actors Sangria Tempest and Storm-0324 previously had been associated with the distribution of the Gozi InfoStealer.”
In April 2022, we observed the first use of an ITG23 crypter with the Gozi banking trojan...
In April 2022, we observed the first use of an ITG23 crypter with the Gozi banking trojan...
Maze affiliates utilize other malware and are involved with other high-end organized crimeware groups conducting systematic corporate data breaches including Zloader, Gozi and TrickBot.
The campaign pivoted from distributing the Ursnif banking trojan in early messages to later distributing Adhubllka ransomware, which encrypts files on compromised systems.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
945 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information stealer mentioned as a historical payload distributed by Storm-0324 and Sangria Tempest. Gozi V3 also appears in the list of Storm-0324's previous payloads; the article does not analyze its operation.
Mentioned as a banking Trojan that attackers repurposed for other malicious activities.
Referenced as a next-stage payload delivered by FakeBat.
Information-stealing trojan used in malicious Word document campaigns with multi-stage script execution for payload delivery.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.