Overview

overview

10

Static

static

Dori.ocx.dll

windows7_x64

10

Dori.ocx.dll

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Dori.ocx

  • Size

    141KB

  • Sample

    201113-8ax8wqrzr6

  • MD5

    745868c40e6f1d1d40ae60335417f6d7

  • SHA1

    cfe42b4014fc22596b4305271c4a133492603349

  • SHA256

    7a5e4fd35a1a636ef1beb7e62cc647d7e63f5c7aadd2aa1a49d49c81183aca93

  • SHA512

    fae585aa131dfa0c5063991fe13938f73c83d78b43ee142ca39e767ec7db6ec7bb419522b4c0c6c210163b05e95db896388446dd8b70b7a29d4c6fe31d130b18

Score
10/10
ursnif_rm3bankertrojan

Malware Config

Targets

    • Target

      Dori.ocx

    • Size

      141KB

    • MD5

      745868c40e6f1d1d40ae60335417f6d7

    • SHA1

      cfe42b4014fc22596b4305271c4a133492603349

    • SHA256

      7a5e4fd35a1a636ef1beb7e62cc647d7e63f5c7aadd2aa1a49d49c81183aca93

    • SHA512

      fae585aa131dfa0c5063991fe13938f73c83d78b43ee142ca39e767ec7db6ec7bb419522b4c0c6c210163b05e95db896388446dd8b70b7a29d4c6fe31d130b18

    Score
    10/10
    ursnif_rm3bankertrojan

    • Ursnif RM3

      A heavily modified version of Ursnif discovered in the wild.

      bankertrojanursnif_rm3

    • Blacklisted process makes network request

    • Deletes itself

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks