Hpursnif

Category: trojan · Aliases: Trojan.Ursnif, Banker.Gozi, Win32/ISFB, Trojan-Banker.Win32.Ursnif · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-01T16:39:01Z

Category: TrojanActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Hpursnif is a highly dangerous and sophisticated alias/variant of the infamous **Ursnif** (also known as Gozi or ISFB) Banking Trojan. Recognized as one of the most prolific and long-standing financial threats in the cybersecurity landscape, Hpursnif is engineered to steal banking credentials, intercept online transactions, and facilitate massive financial fraud, primarily targeting enterprise environments and financial institutions.

Propagation and Execution Lifecycle

Hpursnif utilizes multiple, highly sophisticated vectors for distribution. It is most frequently delivered via targeted spear-phishing campaigns utilizing weaponized Office documents (often containing heavily obfuscated VBA macros or exploiting Equation Editor vulnerabilities) or via exploit kits (like RIG) hosted on compromised websites. Once a host is compromised, Hpursnif's operations are extensive and highly evasive:

Advanced Evasion and Fileless Execution: Modern variants of Hpursnif rely heavily on "fileless" techniques. The initial macro executes PowerShell scripts that download and inject the Hpursnif DLL directly into memory (often into legitimate processes like `explorer.exe`), leaving minimal footprint on the hard drive to evade static antivirus detection.
Web Injection and MitB Attacks: Hpursnif is a classic Man-in-the-Browser (MitB) threat. It hooks into browser APIs (Chrome, Firefox, IE) to intercept web traffic. It injects malicious HTML/JavaScript into legitimate banking websites, allowing attackers to steal login credentials, intercept 2FA tokens, and silently alter wire transfer details in real-time.
Data Exfiltration: Beyond banking, Hpursnif acts as a comprehensive info-stealer, harvesting email credentials, system information, and digital certificates, exfiltrating this data to command-and-control (C2) servers hidden behind Tor or fast-flux networks.

Threat Assessment

An Hpursnif infection is a critical, high-impact security incident. It represents a direct and immediate threat of massive financial loss, corporate account takeover, and severe data breaches for the affected organization. Its use of fileless techniques makes it incredibly difficult to detect and eradicate.

Eradication and Incident Response

Immediate Network Containment: The infected machine must be immediately physically disconnected from the network to halt active financial data exfiltration and prevent the trojan from pivoting laterally.
Financial Account Lockdown: Immediately notify the organization's financial institutions to freeze all associated corporate accounts and closely monitor for unauthorized wire transfers.
System Wipe and Re-image: Attempting to "clean" an Hpursnif infection using antivirus software is highly ineffective due to its in-memory execution and deep system hooks. The only guaranteed method of eradication is a complete wipe and re-image of the compromised host from a known good baseline.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1056.004 T1185 T1114 T1055.001

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_HPURSNIF {
    meta:
        description = "Detects Hpursnif (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "hpursnif" ascii wide nocase
        $s2 = "trojan.ursnif" ascii wide nocase
        $s3 = "banker.gozi" ascii wide nocase
        $s4 = "win32/isfb" ascii wide nocase
        $s5 = "trojan-banker.win32.ursnif" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Hpursnif Activity
id: a72078705cb3c81ab23cecfa52a9480b
status: experimental
description: Detects generic indicators of the hpursnif malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*hpursnif*"
            - "*trojan.ursnif*"
            - "*banker.gozi*"
            - "*win32/isfb*"
            - "*trojan-banker.win32.ursnif*"
    condition: selection
level: medium

References & External Analysis

Search "hpursnif" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Hpursnif Trojan from Windows?

Manual removal of Hpursnif is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Hpursnif a virus or a Trojan?

Hpursnif is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Hpursnif typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Hpursnif infection?

Symptoms of Hpursnif can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: trojan)

Explore other malware families in the same category:

Protect Your Network Against Trojans

Want to prevent Hpursnif and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/hpursnif.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.