Corebot

Overview

Trojan:Win32/Corebot is a highly sophisticated, modular **Banking Trojan** and **Infostealer**. Originally discovered in 2015 acting as a generic credential stealer, Corebot rapidly evolved, integrating a massive web-inject plugin that allowed it to specifically target online banking portals, intercept two-factor authentication (2FA), and steal financial data in real-time. Its highly modular architecture means the botmaster can deploy custom plugins to adapt to new security measures instantly.

Understanding the Corebot Threat
To an end-user, Corebot operates invisibly. When they attempt to log into their bank, the website looks perfectly normal, but the trojan is actively manipulating the HTML content (Web-Injects) to harvest credentials. For a security operations center (SOC), Corebot represents a critical, high-severity breach. Its modular nature (`T1129`) means it can download secondary modules to act as a point-of-sale (POS) scraper, a cryptocurrency wallet thief, or a VNC backdoor.

Execution and Web-Inject Mechanics
Corebot is primarily distributed via highly targeted spear-phishing campaigns or exploit kits (`T1189`). Upon execution (`T1204.002`), it establishes persistence via Registry Run keys (`T1547.001`). Its core functionality relies on advanced process injection (`T1055.001`). It injects its malicious DLL into all active web browsers (`chrome.exe`, `iexplore.exe`, `firefox.exe`). Once injected, it hooks into the browser's networking APIs (like `HttpSendRequest`). When the user visits a targeted banking URL, Corebot intercepts the traffic *before* it is encrypted via SSL/TLS (`T1185`). It then uses its Web-Inject configuration file to modify the DOM of the banking page, presenting the user with fake login forms or requests for 2FA tokens, routing the stolen data directly to the C2 server.

Indicators of Compromise & Impact
The primary impact is catastrophic financial fraud, credential theft, and total compromise of the user's digital identity. Host-based IoCs include EDR alerts for DLL injection into browser processes and the presence of hidden, randomly named directories in `%AppData%` containing encrypted configuration files. Network IoCs include encrypted C2 traffic utilizing custom domain generation algorithms (DGAs).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_COREBOT {
    meta:
        description = "Detects Corebot (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "corebot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Corebot Activity
id: c64f0c794e72ce7a267ccbf0d67f194a
status: experimental
description: Detects generic indicators of the corebot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*corebot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately to prevent the exfiltration of credentials and sever the C2 connection.
2. Reset all passwords for any account accessed from the infected endpoint, prioritizing financial institutions, corporate VPNs, and email accounts.
3. Capture a live memory image (RAM dump) to extract the injected Corebot modules and decrypt its web-inject configuration file to determine which banks were targeted.
4. Wipe the infected system entirely and restore from a known-clean baseline image.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume changing passwords on the infected machine is sufficient; the trojan will simply intercept the new passwords in real-time.
2. Avoid relying on standard antivirus removal; banking trojans deeply hook into the OS and often leave persistent backdoors if not properly wiped.

References & External Analysis

• Search "corebot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Qhosts
• Lockpos
• Game
• Lmkfrhivlcfba
• Xiclog

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/corebot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.