Rewterz Threat Alert – Ursnif Banking Trojan – Active IOCs

Severity

Medium

Analysis Summary

Ursnif is a type of malware that targets Windows systems. It is also known as Gozi or Dreambot and is classified as a banking Trojan. Ursnif is primarily used to steal sensitive information, such as login credentials, financial information, and other personal information. The malware is often spread through phishing emails that contain malicious attachments or links that, when opened, install the malware on the victim’s computer.

Once installed, Ursnif can capture keystrokes, take screenshots, and inject itself into the user’s web browser to intercept and steal information entered into online forms. The malware can also download additional malicious components and communicate with command-and-control servers to receive further instructions from the attackers.

Ursnif is a highly adaptable and persistent threat, and it continues to evolve over time to evade detection and mitigation efforts. To protect against Ursnif and similar threats, it is recommended to use a comprehensive security solution, practice safe browsing habits, and be cautious when opening attachments or links from unknown sources.

Impact

• Information Theft 
• Financial Loss 
• Exposure to Sensitive Information

Indicators of Compromise

MD5

• 2b0d4ccd7c0c123a59c60207d5f2d3bf
• 32c5b4360e5e27be1239cd5aca23cb77
• 9a8206fe88344ea2a5f0b81ab26fdc41
• dfe661247434633a575702de82ab8a80
• 50b019ccc4083430ef43f1f6e15c6601
• c1e86a74acbf99b7c3bd0b1f3bbf97b1

SHA-256

• e656c7f8cba012cb4db32513be31d0a79db61b7ebff4a82e93921638e6e2b377
• 8bce6b0c587906cdaed6c566d9d5d9f213500e942a0234113c07cce2b8e21e2b
• b80157f584d7b327020fabf01e48976c030d87cbc1bab9c3aaf47b60b8ad15c5
• f6f7796cd182ef319981a64c1bec0625712d2839207b27d94cd54c470b2e895c
• 4a71b654dbf6e2c1f34589e7e165c8fccbf4c1fb7d19022c92d7fcde5a91b675
• f3e22541b0b3d84e87fd6c6a50c4c0d6a57f76ee19402002c6da0a3acc5cc3cb

SHA-1

• 7aa850accc1187ada0f727d641f479c970a76369
• 601823cc80c9aecc6ceb238e1dbe6243e35d6bda
• a1cec3147fa1ef80db93ae1596f7ce0c87dc209c
• 23dc628d7a7422497f1008e34780d77e50206547
• 26394d17d0c2fc370607b5b6498d93df2f3e314e
• e32f227e195f2e93fdde11926b319fbc19aa695a

IP

62.173.149.243

Remediation

• Block all threat indicators at your respective controls. 
• Search for IOCs in your environment.