Overview

overview

10

Static

static

5e7740afdd...57.exe

windows7_x64

10

5e7740afdd...57.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8e54a89fc59683cee86de964ec475dea9fc5618b.zip.zip
  • Size 135KB
  • Sample201218-4wka233k46
  • SHA256 5d3a9e1174f1e86b5511dbdd77f164e064e95be04d3b391b3c0538882c05db85
  • MD5 SHA1 SHA512
Score
10/10
ursnif3400bankertrojan

Malware Config

Extracted

Family

  • ursnif

Botnet

  • 3400

C2

  • microsoft.com

  • update.microsoft.com

  • avast.com

  • tm90daron.club

  • jamericohermann.com

  • b9437ariane.com

rsa_pubkey.base64
serpent.plain

Targets

    • Target
      5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57
    • Size 208KB
    • SHA256 5e7740afdd5c5865a2304e2f7c5fc3f1cd1016f503a4b1752923f44059fd1a57
    • MD5 SHA1 SHA512
    Score
    10/10
    ursnif3400bankertrojan

    • Ursnif, Dreambot

      Ursnif is a variant of the Gozi IFSB with more capabilities.

      bankertrojanursnif
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks