Procedure examples

Ursnif has collected files from victim machines, including certificates and cookies.

Ursnif has gathered information about running services.

Ursnif has used Reg to query the Registry for installed programs.

Ursnif droppers execute base64 encoded PowerShell commands.

Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk. Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.

Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.

Ursnif has used HTTP POSTs to exfil gathered information.

Ursnif droppers have used WMI classes to execute PowerShell commands.

Ursnif has injected code into target processes via thread local storage callbacks.

Ursnif has used process hollowing to inject into child processes.

Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.

Ursnif has gathered information about running processes.

Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.

Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.

Ursnif has deleted data staged in tmp files after exfiltration.

Ursnif has used HTTPS for C2.

Ursnif has used tmp files to stage gathered information.

Ursnif has copied itself to and infected files in network drives for propagation.

Ursnif has used Systeminfo to gather system information.

Ursnif has used a peer-to-peer (P2P) network for C2.

Ursnif has used Tor for C2.

Ursnif has copied itself to and infected removable drives for propagation.

Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.

Ursnif has used CreateProcessW to create child processes.

Ursnif has used Registry modifications as part of its installation routine.

Ursnif has used hooked APIs to take screenshots.

Ursnif has used encoded data in HTTP URLs for C2.

Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.

Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).

Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.

Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.

Ursnif has used Registry Run keys to establish automatic execution at system startup.

Ursnif droppers have used COM objects to execute the malware's full executable payload.

Ursnif droppers have used COM properties to execute malware in hidden windows.

Ursnif has used a DGA to generate domain names for C2.