{
  "family": "corebot",
  "sample_count": 7,
  "category": "trojan",
  "description": "Trojan:Win32/Corebot is a highly sophisticated, modular **Banking Trojan** and **Infostealer**. Originally discovered in 2015 acting as a generic credential stealer, Corebot rapidly evolved, integrating a massive web-inject plugin that allowed it to specifically target online banking portals, intercept two-factor authentication (2FA), and steal financial data in real-time. Its highly modular architecture means the botmaster can deploy custom plugins to adapt to new security measures instantly.<br><br><b>Understanding the Corebot Threat</b><br>To an end-user, Corebot operates invisibly. When they attempt to log into their bank, the website looks perfectly normal, but the trojan is actively manipulating the HTML content (Web-Injects) to harvest credentials. For a security operations center (SOC), Corebot represents a critical, high-severity breach. Its modular nature (`T1129`) means it can download secondary modules to act as a point-of-sale (POS) scraper, a cryptocurrency wallet thief, or a VNC backdoor.<br><br><b>Execution and Web-Inject Mechanics</b><br>Corebot is primarily distributed via highly targeted spear-phishing campaigns or exploit kits (`T1189`). Upon execution (`T1204.002`), it establishes persistence via Registry Run keys (`T1547.001`). Its core functionality relies on advanced process injection (`T1055.001`). It injects its malicious DLL into all active web browsers (`chrome.exe`, `iexplore.exe`, `firefox.exe`). Once injected, it hooks into the browser's networking APIs (like `HttpSendRequest`). When the user visits a targeted banking URL, Corebot intercepts the traffic *before* it is encrypted via SSL/TLS (`T1185`). It then uses its Web-Inject configuration file to modify the DOM of the banking page, presenting the user with fake login forms or requests for 2FA tokens, routing the stolen data directly to the C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is catastrophic financial fraud, credential theft, and total compromise of the user's digital identity. Host-based IoCs include EDR alerts for DLL injection into browser processes and the presence of hidden, randomly named directories in `%AppData%` containing encrypted configuration files. Network IoCs include encrypted C2 traffic utilizing custom domain generation algorithms (DGAs).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1129",
    "T1185",
    "T1055.001",
    "T1552.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Browser Web-Injects)",
      "tactic": "Collection"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1129",
      "name": "Shared Modules (Modular plugin architecture)",
      "tactic": "Execution"
    },
    {
      "id": "T1552.001",
      "name": "Credentials In Files (Stealing stored browser passwords)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent the exfiltration of credentials and sever the C2 connection.",
    "Reset all passwords for any account accessed from the infected endpoint, prioritizing financial institutions, corporate VPNs, and email accounts.",
    "Capture a live memory image (RAM dump) to extract the injected Corebot modules and decrypt its web-inject configuration file to determine which banks were targeted.",
    "Wipe the infected system entirely and restore from a known-clean baseline image."
  ],
  "what_to_avoid": [
    "Do not assume changing passwords on the infected machine is sufficient; the trojan will simply intercept the new passwords in real-time.",
    "Avoid relying on standard antivirus removal; banking trojans deeply hook into the OS and often leave persistent backdoors if not properly wiped."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}