aol.pm

Bankshot

Software · ATTACK:enterprise:S0239

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0239",
  "title": "Bankshot",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0239",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--1f6e3702-7ca1-4582-b2e7-4591297d05a8",
  "external_id": "S0239",
  "domain": "enterprise",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2025-10-22T02:26:07.951Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Bankshot"
    },
    {
      "source_name": "Trojan Manuscript"
    },
    {
      "source_name": "McAfee Bankshot",
      "url": "https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"
    }
  ]
}

Explicit source assertions (26)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fd9bb83-40f0-42ae-8e73-5d207434a757

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--119cfc44-4018-4ce0-b223-b0f353d1c113

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--172a8a26-d2c9-4d29-b050-55949c0186dd

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25d926a0-d2b5-473d-b27b-fb69cf763b77

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26352538-769c-42c0-9e38-0338c5891432

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--314a5160-17e0-44eb-9f4b-1a8e216b56a2

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37ece881-96cf-441a-981d-ff3eeac292d7

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5412525e-cba5-4fa1-89ff-7e6fa2b92e24

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55de5c21-4cb1-4235-89b5-df77dfc7fa90

McAfee Bankshot · US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5782aac5-a4c6-4d17-88c9-e29b795e3ee7

McAfee Bankshot · US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70648d67-a2f5-4021-8ffe-3bbcdbe8e78f

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77d079b6-2df9-4ae9-bc7c-1ebe99708660

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1132.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78f8338a-ac4e-42cf-a887-cc35e842dc11

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87648492-36d0-4f94-b318-17280b101678

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--945a3286-2197-4984-8838-837afcd7925c

MAR10135536-B

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a15e391d-cc21-484d-839a-b7057ae40179

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a35c951b-5987-4028-b002-a2078ad9c0a7

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac6ce385-79d5-40bd-ab16-bd873fb1a821

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0d119a2-c5f9-4c18-a18c-28bfa576ea9a

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1134.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c151ee77-66ca-4b86-bc13-84759cf71321

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9a7b725-bdab-4955-a963-b747a406102b

McAfee Bankshot · US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb297293-d9bb-484a-a9fb-b7b09477d38f

McAfee Bankshot

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d760ae68-4127-4fec-814b-020a40f7b4e5

McAfee Bankshot · US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df520c15-50fc-46cf-8559-368e88072aa7

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9b71895-a9d2-4023-930b-4204f6c2d325

US-CERT Bankshot Dec 2017

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0239

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa0622d6-2b58-476f-9c57-e629785b0415

McAfee Bankshot

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.