Bankfraud

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Credential Harvesting (Phishing Pages): The core component is often an HTML/JavaScript payload that renders a pixel-perfect replica of a bank's login portal. The malware intercepts the data submitted into this fake form and transmits it via HTTP POST directly to the attacker.
• Local Data Theft: Some variants may scan the local filesystem for files with names like `passwords.txt`, `wallet.dat`, or `taxes.pdf`, exfiltrating them to an external server.
• Social Engineering Hooks: The malware may display persistent, alarming pop-ups on the desktop instructing the user to "verify their account immediately" by clicking a link or calling a fraudulent phone number to speak with a "fraud analyst."

Threat Assessment

Incident Response and Remediation

• Emergency Financial Freeze: The absolute highest priority is freezing the compromised accounts. Contact the affected financial institution immediately to halt any pending transactions and cancel associated credit cards.
• Universal Credential Reset: The victim must immediately reset their banking passwords from a *known-secure, separate device*. Furthermore, any other accounts sharing that password must also be changed.
• Endpoint Sweeps: While Bankfraud is often web-based, if an executable or malicious document was downloaded, perform a full sweep with an enterprise anti-malware solution to ensure no persistent backdoors or keyloggers were left behind.

Known aliases

Threat reports may refer to this family under multiple names:

• Trojan.Bankfraud
• Phish.Bankfraud
• Fraud.Win32

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1566.001 T1566.002 T1056.002

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.002: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.
• T1566.002: Inspect email links for known malicious domains and use link-rewriting services for time-of-click analysis.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BANKFRAUD {
    meta:
        description = "Detects Bankfraud (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "bankfraud" ascii wide nocase
        $s2 = "trojan.bankfraud" ascii wide nocase
        $s3 = "phish.bankfraud" ascii wide nocase
        $s4 = "fraud.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Bankfraud Activity
id: 2c99cd40bcbe3884f74fddd90decf250
status: experimental
description: Detects generic indicators of the bankfraud malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*bankfraud*"
            - "*trojan.bankfraud*"
            - "*phish.bankfraud*"
            - "*fraud.win32*"
    condition: selection
level: medium

References & External Analysis

• Search "bankfraud" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Xxybwe
• Wfpdisabler
• Bundleloader
• Pjzab0Jsupjb
• Genericrxby

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/bankfraud.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.