Ursnif
Software · ATTACK:enterprise:S0386
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0386",
"title": "Ursnif",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0386",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--1492d0f8-7e14-4af3-9239-bc3fe10d3407",
"external_id": "S0386",
"domain": "enterprise",
"created": "2019-06-04T18:42:22.552Z",
"modified": "2024-09-12T19:50:37.023Z",
"version": "1.5",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Gozi-ISFB"
},
{
"source_name": "Ursnif"
},
{
"source_name": "Dreambot"
},
{
"source_name": "PE_URSNIF"
},
{
"source_name": "TrendMicro Ursnif Mar 2015",
"url": "https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"
},
{
"source_name": "NJCCIC Ursnif Sept 2016",
"url": "https://www.cyber.nj.gov/threat-landscape/malware/trojans/ursnif"
},
{
"source_name": "ProofPoint Ursnif Aug 2016",
"url": "https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"
},
{
"source_name": "FireEye Ursnif Nov 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html"
}
]
}Explicit source assertions (36)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00490a17-1032-461b-8085-500d56bb80f5
TrendMicro Ursnif Mar 2015ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--084fc3bc-5e50-47fb-97d1-75fa00b6ed79
TrendMicro PE_URSNIF.A2 · TrendMicro BKDR_URSNIF.SMATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d88d99d-88b0-4e49-b2c3-3607a32069ed
TrendMicro PE_URSNIF.A2 · TrendMicro BKDR_URSNIF.SMATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--117ca63e-7fdb-41e6-9f4b-e19a0e889061
Bromium Ursnif Mar 2017 · ProofPoint Ursnif Aug 2016ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--186ee163-fb1f-4a7d-b7d9-3c01efbb2be0
NJCCIC Ursnif Sept 2016 · ProofPoint Ursnif Aug 2016ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e46f5cf-dfaf-4cc6-a685-ee876f371b7e
TrendMicro Ursnif Mar 2015ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1eb02abf-4bad-4672-a0dd-73fffc02bb47
FireEye Ursnif Nov 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--281eabd3-1965-4b62-8862-1edb15d49701
TrendMicro Ursnif File Dec 2014ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1559.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c4d8c8f-9676-48c5-b902-e95a2411e266
Bromium Ursnif Mar 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1056.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c7ad637-8d4e-4baa-9cd9-7655d29e1e28
TrendMicro Ursnif Mar 2015ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--416447f0-410b-46d6-a4f8-e67ba3c9052f
TrendMicro Ursnif Mar 2015 · TrendMicro BKDR_URSNIF.SMATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42de94e7-86f3-41d9-9e01-45fff8be1451
TrendMicro Ursnif Mar 2015 · ProofPoint Ursnif Aug 2016 · FireEye Ursnif Nov 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1132
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45a113e7-452c-4bf3-9962-b0f71f386095
ProofPoint Ursnif Aug 2016ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1055.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e8621ee-9a1f-4a61-86f4-aae3c3d20d0c
TrendMicro Ursnif Mar 2015 · TrendMicro PE_URSNIF.A2 · FireEye Ursnif Nov 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ee02f06-6250-4c75-b20f-c3271442f59e
ProofPoint Ursnif Aug 2016ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72b03734-7e03-4cfe-8f0f-2d366febfb79
TrendMicro Ursnif Mar 2015ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7942bbcc-cff9-4cc6-b568-5fcd3b6a5ddf
TrendMicro BKDR_URSNIF.SMATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bb7b19e-83dc-4095-83b5-f647bf5f2800
Bromium Ursnif Mar 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83c4e8d9-1746-43eb-af67-71e10a24da6f
TrendMicro Ursnif Mar 2015 · TrendMicro BKDR_URSNIF.SMATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89ed7e05-1f94-4693-b290-96c3a9ecd615
TrendMicro PE_URSNIF.A2ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b368877-93b8-4ea9-84ef-84232412982f
Bromium Ursnif Mar 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--957e1f09-4474-4c22-a7fd-7d70d3be61ff
TrendMicro Ursnif Mar 2015 · ProofPoint Ursnif Aug 2016 · FireEye Ursnif Nov 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b095c7b-09a8-4d4a-8452-98a2f069e73f
TrendMicro Ursnif Mar 2015ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a16da3e1-c81e-4565-a78f-607cb937010b
TrendMicro Ursnif Mar 2015 · TrendMicro BKDR_URSNIF.SMATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6252cbd-82a6-4cd6-a5f6-74507cd49f72
TrendMicro BKDR_URSNIF.SM · ProofPoint Ursnif Aug 2016ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1568.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab589bd1-49d3-422e-ac25-c24d2964b258
ProofPoint Ursnif Aug 2016ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5ebcf96-92f6-46d3-a9a1-1773e4f3ec02
Bromium Ursnif Mar 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b892d69f-bdfc-48e8-83f5-3081b9bffa4a
TrendMicro Ursnif Mar 2015ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2bbf923-e30e-4888-894c-7c8ba655c753
NJCCIC Ursnif Sept 2016 · ProofPoint Ursnif Aug 2016ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9c20d20-cd4a-45cf-81a2-e9a8f6c9e78c
Bromium Ursnif Mar 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1ba1028-0125-4f0e-8ccd-9273deac9d18
FireEye Ursnif Nov 2017ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1185
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eafddae6-8e14-491b-82af-40ddaccb99c6
TrendMicro BKDR_URSNIF.SMATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0386
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eca046f5-9175-4010-8297-07281f588934
Cybereason Valak May 2020 · Unit 42 Valak July 2020 · Unit 42 TA551 Jan 2021 · Secureworks GOLD CABINATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5faa97f-761c-4978-8535-2d9a42fcdd6f
TrendMicro Ursnif File Dec 2014 · TrendMicro Ursnif Mar 2015ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc0432e9-1b49-4be8-b86e-15cdec6b070e
TrendMicro Ursnif File Dec 2014 · TrendMicro Ursnif Mar 2015ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcd9b8a1-60c0-4d6b-9742-77f9104f8e56
Bromium Ursnif Mar 2017