Loading malware…
ISFB, also known as Ursnif and as a successor lineage of Gozi, is a long-running Windows banking trojan family used for online banking fraud, credential theft, and broader post-compromise monetization. It emerged as a heavily reworked descendant of leaked Gozi code and evolved into multiple branches operated by different criminal groups, including variants such as Dreambot and later loader-oriented branches. Over time, the family shifted from classic banking theft toward acting as a modular access platform and malware loader for additional payloads, including ransomware-enabling operations.
ISFB is designed to intercept, analyze, and modify web traffic on infected systems, including HTTPS sessions, enabling man-in-the-browser style fraud, web injects, form grabbing, and browser content replacement. Documented capabilities include theft of browser credentials and cookies, banking data, email and FTP data, certificates, screenshots, files, and keylogged input. Some branches also support SOCKS proxying, plugin loading, execution of downloaded payloads, and remote control functions. The malware commonly injects into browser processes and explorer.exe, with distinct components handling traffic interception, command processing, and system-level tasking.
The family uses flexible command-and-control mechanisms. Known implementations support predefined domain lists, domain generation, signed configuration updates, encrypted communications, and stealthier retrieval methods through COM automation of Internet Explorer components. Reverse-engineering of modern loaders shows staged delivery, host fingerprinting, registry-based storage of payloads and scripts, PowerShell-assisted execution, APC-style process injection, and self-deletion. Persistence has been observed through autorun registration and Registry Run keys.
ISFB infections have been delivered through multiple vectors depending on operator and campaign, including malicious Office macro documents, phishing, and fake software installers distributed via malvertising or SEO-poisoned download pages. It has also been observed as a payload delivered by other malware such as BatLoader. The malware primarily targets Windows endpoints and has historically focused on financial theft, especially online banking users, while later campaigns increasingly supported broader criminal intrusion workflows.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
I’m finally getting round to writing this post – for the past few months I have been analysing different versions of ISFB/Ursnif/Gozi... In a nutshell, ISFB is a banking trojan used to steal financial information from unsuspecting victims.
ISFB is a malware family encapsulating a whole set of tools primarily used to defraud online banking accounts; it is a banking trojan.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
Ursnif Mitre Att&ck TTP Map: ... Windows Management Instrumentation (T1047)
This is then executed using COM API once again, rather than calling a well known API such as ShellExecuteExW()
The malicious actor(s) create a custom action to run the malicious PowerShell inline script. The malicious script resides under AI_DATA_SETTER action name and contains the instructions to download the malicious update.bat file from the C2 domain
This specific sample of ISFB is version 2.14.60, and can be attributed to a specific ISFB v2 group based on the infection routine used – specifically the macros that execute a powershell command that is simply Base64 encoded.
The code is responsible for importing DLLs using the previously imported API’s... The DLLs that are loaded are; NTDLL.DLL, KERNEL32.DLL, AND OLEAUT32.DLL.
When a victim opens the Word document... the document content deceives victims to click the “Enable Content” button.
When a victim opens the Word document, it displays a security warning message... the document content deceives victims to click the “Enable Content” button... the malicious VBA code is executed because the code is in an AutoOpen sub that is executed at opening the document.
It does so by altering 3 registry keys: SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown_TIMESTAMP ... Check_Associations | Four registry keys are created, containing the two downloaded, encrypted executables, the Powershell script, and a WMIC command executing the Powershell script
The script performs process injection using the API such as OpenThread, VirtualAlloc, and QueueUserAPC... We have observed ISFB injecting itself into a running explorer.exe process.
QueueUserAPC is executed, specifying the current thread within its process... SleepEx is used to trigger an alertable state completing the APC injection
After downloading the binary file, it retrieves the handle of explorer.exe process and calls UpdateProcThreadAttribute to perform parent PID spoofing... to evade detection.
the configuration acts as a lookup table, pointing to the real configuration data such as the URLs or Botnet ID – this means the loader doesn’t have to search the entire config to locate a certain value
The script performs process injection using the API such as OpenThread, VirtualAlloc, and QueueUserAPC... We have observed ISFB injecting itself into a running explorer.exe process.
QueueUserAPC is executed, specifying the current thread within its process... SleepEx is used to trigger an alertable state completing the APC injection
After downloading the binary file, it retrieves the handle of explorer.exe process and calls UpdateProcThreadAttribute to perform parent PID spoofing... to evade detection.
After the code is Base64 decoded... It continues to decode the data, then decompresses it to get the final PowerShell code.
Ursnif Mitre Att&ck TTP Map: ... System Binary Proxy Execution – Regsvr32 (T1218.010)
Once the strings have been decrypted, ISFB then calls a function that utilizes one of the decrypted strings – IsWow64Process. As you probably have guessed, this checks to see if the architecture of the system is 64 bit or not.
Next, the malware will allocate a brand new section of memory using NtCreateSection(), which will be set to Read-Write-eXecute... the program begins to copy over the executable to the new addresses, however it skips the entire MZ header and simply copies everything from the PE header. | there are several calls to API’s, in particular VirtualProtect. VirtualProtect is responsible for changing the permissions/protection of different memory regions...
It does so by altering 3 registry keys: SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown_TIMESTAMP ... Check_Associations | Four registry keys are created, containing the two downloaded, encrypted executables, the Powershell script, and a WMIC command executing the Powershell script
GET_KEYLOG - отправить данные кейлоггера... KEYLOG_ON[= list] - включить кейлог, для заданного списка процессов
Ursnif Mitre Att&ck TTP Map: ... Input Capture: GUI (Graphical User Interface) Input Capture (T1056.002)
MITRE ATT&CK Tactic Unsecured Credentials ID T1552.001 MITRE ATT&CK Technique Unsecured Credentials: Credentials In Files Description The ISFB version observed is capable of accessing browser credentials and cookies, Thunderbird and Outlook profiles, POP3, SMTP passwords.
Registry query information (details of installed applications) – reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
It collects some information from the host machine like computer name, username, uptime, and CRC... Ursnif malware also collects and sends the following sensitive system information: Output of System Info command
- найти файл по маске и оправить на сервер... GET_FILES=* - найти все файлы, соответствующие заданной маске, и отправить на сервер
GET_KEYLOG - отправить данные кейлоггера... KEYLOG_ON[= list] - включить кейлог, для заданного списка процессов
Ursnif Mitre Att&ck TTP Map: ... Input Capture: GUI (Graphical User Interface) Input Capture (T1056.002)
Ursnif then starts capturing keylogging and clipboard events in the system and sends it to the attacker’s CnC at regular intervals.
ISFB - программа-бот предназначенная для анализа и модификации HTTP траффика на компьютере клиента... Анализ траффика производится на основе специально сформированного файла конфигурации... - подмена HTML страницы целиком - замена фрагмента HTML страницы - скопировать фрагмент страницы и отправить на сервер
The string is Serpent CBC encrypted, with the 16 byte config key + 16 byte nulled IV... A random string is prepended, the string is Base64 encoded, '+' and '/' are replaced with hex equivalents, random '/' are added to string, '/images/' is prepended and '.avi' is appended
decrypt the URL check-in on the fly to get the data sent to the C2 server | A different version inserts the encrypted path as data of a POST request.
Обрабатывает весь HTTP траффик браузера в том числе и шифрованый HTTPS.
64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
ISFB is referenced as leaked banking malware code incorporated into Nymaim, giving it banking capabilities and influencing elements such as inject parsing and data structures.
Banking malware used as a BatLoader-delivered payload. The observed variant steals browser credentials and cookies, Thunderbird and Outlook profiles, POP3/SMTP passwords, may target crypto wallets and banking data, establishes persistence via Registry Run keys, injects into explorer.exe, and supports man-in-the-browser style activity.
A long-running banking trojan family derived from leaked Gozi v1 source code, with capabilities including victim fingerprinting, second-stage loading, keylogging, form grabbing, webinjects, browser redirection/replacers, VNC/SOCKS proxying, screen recording, email theft, and file theft. The content also states operators often use it as an entry point for second-stage attacks such as ransomware or extortion.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.