{
  "family": "hpursnif",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nHpursnif is a highly dangerous and sophisticated alias/variant of the infamous **Ursnif** (also known as Gozi or ISFB) Banking Trojan. Recognized as one of the most prolific and long-standing financial threats in the cybersecurity landscape, Hpursnif is engineered to steal banking credentials, intercept online transactions, and facilitate massive financial fraud, primarily targeting enterprise environments and financial institutions.\n\n<h3>Propagation and Execution Lifecycle</h3>\nHpursnif utilizes multiple, highly sophisticated vectors for distribution. It is most frequently delivered via targeted spear-phishing campaigns utilizing weaponized Office documents (often containing heavily obfuscated VBA macros or exploiting Equation Editor vulnerabilities) or via exploit kits (like RIG) hosted on compromised websites.\n\nOnce a host is compromised, Hpursnif's operations are extensive and highly evasive:\n<ul>\n<li><strong>Advanced Evasion and Fileless Execution:</strong> Modern variants of Hpursnif rely heavily on \"fileless\" techniques. The initial macro executes PowerShell scripts that download and inject the Hpursnif DLL directly into memory (often into legitimate processes like `explorer.exe`), leaving minimal footprint on the hard drive to evade static antivirus detection.</li>\n<li><strong>Web Injection and MitB Attacks:</strong> Hpursnif is a classic Man-in-the-Browser (MitB) threat. It hooks into browser APIs (Chrome, Firefox, IE) to intercept web traffic. It injects malicious HTML/JavaScript into legitimate banking websites, allowing attackers to steal login credentials, intercept 2FA tokens, and silently alter wire transfer details in real-time.</li>\n<li><strong>Data Exfiltration:</strong> Beyond banking, Hpursnif acts as a comprehensive info-stealer, harvesting email credentials, system information, and digital certificates, exfiltrating this data to command-and-control (C2) servers hidden behind Tor or fast-flux networks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Hpursnif infection is a critical, high-impact security incident. It represents a direct and immediate threat of massive financial loss, corporate account takeover, and severe data breaches for the affected organization. Its use of fileless techniques makes it incredibly difficult to detect and eradicate.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Immediate Network Containment:</strong> The infected machine must be immediately physically disconnected from the network to halt active financial data exfiltration and prevent the trojan from pivoting laterally.</li>\n<li><strong>Financial Account Lockdown:</strong> Immediately notify the organization's financial institutions to freeze all associated corporate accounts and closely monitor for unauthorized wire transfers.</li>\n<li><strong>System Wipe and Re-image:</strong> Attempting to \"clean\" an Hpursnif infection using antivirus software is highly ineffective due to its in-memory execution and deep system hooks. The only guaranteed method of eradication is a complete wipe and re-image of the compromised host from a known good baseline.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Ursnif",
    "Banker.Gozi",
    "Win32/ISFB",
    "Trojan-Banker.Win32.Ursnif"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.004",
    "T1185",
    "T1114",
    "T1055.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:39:01Z",
  "type": "Banking Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}