Threat intelligence / Malware

Ursnif

[Ursnif](https://attack.mitre.org/software/S0386) is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)s, and malicious links.(Citation: NJCCIC Ursnif Sept 2016)(Citation: ProofPoint Ursnif Aug 2016) [Ursnif](https://attack.mitre.org/software/S0386) is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.(Citation: TrendMicro Ursnif Mar 2015)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Labels

malware

36 recorded

Relationships

uses

from TA551

Group

uses

to Browser Session Hijacking

Technique

uses

to Command Obfuscation

Technique

uses

to Component Object Model

Technique

uses

to Credential API Hooking

Technique

uses

to Data Encoding

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File Deletion

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Multi-hop Proxy

Technique

uses

to Native API

Technique

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Proxy

Technique

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Replication Through Removable Media

Technique

uses

to Screen Capture

Technique

uses

to System Information Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Taint Shared Content

Technique

uses

to Thread Local Storage

Technique

uses

to Time Based Checks

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

9 external

References

mitre-attack

S0386

open

Gozi-ISFB

—

Ursnif

—

Dreambot

—

PE_URSNIF

—

TrendMicro Ursnif Mar 2015

https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992

open

NJCCIC Ursnif Sept 2016

https://www.cyber.nj.gov/threat-landscape/malware/trojans/ursnif

open

ProofPoint Ursnif Aug 2016

https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality

open

FireEye Ursnif Nov 2017

https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html

open