Tricks and COMfoolery: How Ursnif (Gozi) Evades Detection

In February we saw a resurgence of Ursnif (also known as Gozi), a credential-stealing Trojan. Learn how Ursnif bypasses an attack surface reduction rule.

Ursnif Trojan - Malware removal instructions (updated)

Malware Analysis — Gozi/Ursnif Downloader, by ka1d0

Windows Management Instrumentation, Technique T1047 - Enterprise

Tricks and COMfoolery: How Ursnif Evades Detection - Security Boulevard

Unwrapping Ursnifs Gifts - The DFIR Report

Use behavioral analysis to detect a new Ursnif banking Trojan campaign in Japan

Wireshark Tutorial: Examining Ursnif Infections

Use behavioral analysis to detect a new Ursnif banking Trojan campaign in Japan

Wireshark Tutorial: Examining Ursnif Infections

SAIGON, the Mysterious Ursnif Fork

Wireshark Tutorial: Examining Ursnif Infections

Ursnif Trojan - Malware removal instructions (updated)

Tricks and COMfoolery: How Ursnif (Gozi) Evades Detection