ursnif_rm3 | b6815b7c6bd39d114da295e839d472997b073db3d57429aadad20bb73c7b47c2 | Triage

Sharing

General

Target

9ba1149497898221f41d5261e8d89262.exe
Size

332KB
Sample

200712-g1z3hvn8jj
MD5

9ba1149497898221f41d5261e8d89262
SHA1

6bc9fe3fa8ba6775b35b6d20984efdb121112bea
SHA256

b6815b7c6bd39d114da295e839d472997b073db3d57429aadad20bb73c7b47c2
SHA512

104607d0a42400d58bb820df02e23d2e2bd7d2d75ccf3a6ca7271d7c83dec8e948b689756e5b31ee1a9569a74dc363509ec98a3f45c00492c1861882ae7c97fa

Score

10^/10

ursnif_rm3 banker evasion spyware trojan

Malware Config

Targets

- Target
  
  9ba1149497898221f41d5261e8d89262.exe
- Size
  
  332KB
- MD5
  
  9ba1149497898221f41d5261e8d89262
- SHA1
  
  6bc9fe3fa8ba6775b35b6d20984efdb121112bea
- SHA256
  
  b6815b7c6bd39d114da295e839d472997b073db3d57429aadad20bb73c7b47c2
- SHA512
  
  104607d0a42400d58bb820df02e23d2e2bd7d2d75ccf3a6ca7271d7c83dec8e948b689756e5b31ee1a9569a74dc363509ec98a3f45c00492c1861882ae7c97fa
Score

10^/10

evasion spyware trojan banker ursnif_rm3
- Ursnif RM3
  A heavily modified version of Ursnif discovered in the wild.
  banker trojan ursnif_rm3
- Modifies system certificate store
  evasion spyware trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionspywaretrojanbankerursnif_rm3

behavioral2