{
  "family": "krbanker",
  "sample_count": 21,
  "category": "trojan",
  "description": "Trojan:Win32/Krbanker is a sophisticated financial trojan explicitly designed to target online banking customers, primarily focusing on financial institutions within South Korea. It aims to steal credentials, intercept two-factor authentication (2FA), and perform unauthorized fund transfers.<br><br><b>Understanding Krbanker</b><br>To the victim, Krbanker is entirely invisible until fraudulent transactions appear on their bank statements. For a security analyst, Krbanker represents a highly localized, targeted threat. Unlike global botnets (like Emotet), Krbanker's code, web injects, and C2 infrastructure are specifically tailored to bypass the unique security controls (such as AhnLab Safe Transaction or specific PKI certificate requirements) mandated by South Korean banks.<br><br><b>Execution and Financial Theft Tactics</b><br>Krbanker is typically distributed via spearphishing or by compromising regional websites to host exploit kits (`T1189`). Upon execution, it establishes persistence via Registry Run keys. It injects its core DLL into the web browser process (`T1055.001`). When the user navigates to a targeted Korean banking portal, Krbanker utilizes 'Man-in-the-Browser' (MitB) techniques (`T1185`). It injects malicious HTML directly into the DOM, creating fake pop-ups that request the user's security card numbers, account passwords, and digital certificates (`T1111`). It also frequently alters the DNS settings or the local `hosts` file (`T1562.002`) to redirect legitimate banking URLs to attacker-controlled phishing pages.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe financial fraud. EDR platforms must alert on the injection of DLLs into browser processes or the unauthorized modification of the `C:\\Windows\\System32\\drivers\\etc\\hosts` file. Network logs will reveal DNS resolution for legitimate banking domains pointing to anomalous, foreign IP addresses. Memory analysis is necessary to extract the specific web inject configurations.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1552.004",
    "T1055.001",
    "T1562.002",
    "T1111"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Man-in-the-Browser",
      "tactic": "Collection"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.002",
      "name": "Impair Defenses: Disable Windows Event Logging",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1552.004",
      "name": "Unsecured Credentials: Private Keys",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; the attacker has active, real-time control over the user's web browser sessions.",
    "Initiate a mandatory password reset for all financial and corporate accounts accessed from the infected machine, utilizing a known-clean device.",
    "Revoke and reissue any digital certificates (PKI) stored on the infected machine, as Krbanker specifically targets these for theft.",
    "Audit the local `hosts` file and DNS settings to ensure traffic is not being actively redirected to phishing infrastructure."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into any sensitive portal to 'check their balance'; the MitB trojan will intercept the login and modify the displayed balance.",
    "Avoid assuming a simple AV scan fixes the issue; banking trojans deeply hook into the OS and often require a full rebuild."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}