{
    "type": "bundle",
    "id": "bundle--c77e8035-6ca8-451e-94ae-496198e6e7a5",
    "spec_version": "2.0",
    "objects": [
        {
            "modified": "2023-03-22T05:42:32.541Z",
            "name": "Ursnif",
            "description": "[Ursnif](https://attack.mitre.org/software/S0386) is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)s, and malicious links.(Citation: NJCCIC Ursnif Sept 2016)(Citation: ProofPoint Ursnif Aug 2016) [Ursnif](https://attack.mitre.org/software/S0386) is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.(Citation: TrendMicro Ursnif Mar 2015)",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack"
            ],
            "x_mitre_version": "1.4",
            "x_mitre_aliases": [
                "Ursnif",
                "Gozi-ISFB",
                "PE_URSNIF",
                "Dreambot"
            ],
            "type": "malware",
            "id": "malware--1492d0f8-7e14-4af3-9239-bc3fe10d3407",
            "created": "2019-06-04T18:42:22.552Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0386",
                    "external_id": "S0386"
                },
                {
                    "source_name": "Gozi-ISFB",
                    "description": "(Citation: FireEye Ursnif Nov 2017)(Citation: ProofPoint Ursnif Aug 2016)"
                },
                {
                    "source_name": "Ursnif",
                    "description": "(Citation: NJCCIC Ursnif Sept 2016)"
                },
                {
                    "source_name": "Dreambot",
                    "description": "(Citation: NJCCIC Ursnif Sept 2016)(Citation: ProofPoint Ursnif Aug 2016)"
                },
                {
                    "source_name": "PE_URSNIF",
                    "description": "(Citation: TrendMicro Ursnif Mar 2015)"
                },
                {
                    "source_name": "TrendMicro Ursnif Mar 2015",
                    "description": "Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.",
                    "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-the-multifaceted-malware/?_ga=2.165628854.808042651.1508120821-744063452.1505819992"
                },
                {
                    "source_name": "NJCCIC Ursnif Sept 2016",
                    "description": "NJCCIC. (2016, September 27). Ursnif. Retrieved June 4, 2019.",
                    "url": "https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif"
                },
                {
                    "source_name": "ProofPoint Ursnif Aug 2016",
                    "description": "Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.",
                    "url": "https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"
                },
                {
                    "source_name": "FireEye Ursnif Nov 2017",
                    "description": "Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif Variant Employs Malicious TLS Callback Technique to Achieve Process Injection. Retrieved June 5, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "labels": [
                "malware"
            ],
            "x_mitre_attack_spec_version": "3.1.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        }
    ]
}