MalwaremediumExploited in the wild

Banking Trojans: Ursnif Global Distribution Networks Identified

Palo Alto Unit 42by Kaoru HayashiAug 17, 2026 · 12:56 UTC (Aug 17, 2026)5 min read2

AI summary · glm-5.3-flashSummaries by Vani AI

Unit 42 maps banking-trojan distribution networks: spam botnets push Shiotob downloaders and Ursnif, KINS, Tinba at Japan and European targets via compromised web servers.

Unit 42 identified the distribution networks behind banking trojan attacks against Japan, Italy, Spain, Poland, Australia, and Germany. A spam botnet delivered 75 unique Shiotob (Bebloh/URLZone) variants across 7 million spam emails, with Shiotob acting mainly as a downloader that installs Ursnif and the Pushdo spam bot from C2 commands. Over 200 malicious files were hosted on 74 compromised, mostly European small-business web servers between April 2015 and January 2017, with localized invoice and photo-themed email lures per target country.

Key facts

Shiotob (Bebloh/URLZone) acts as downloader installing Ursnif and Pushdo spam bot.
75 unique Shiotob variants found across 7 million spam emails to Japanese targets.
74 compromised European web servers hosted over 200 malicious files since April 2015.
Localized email lures (invoices, orders, photos) targeted six countries including Japan and Italy.
Tokyo Metropolitan Police and Japan CCC publicly warned about the malicious email activity.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

ATT&CK: T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer T1071.001 Web Protocols

Tags: banking-trojan europe gozi japan pushdo shiotob spam-botnet ursnif

Vendors: Palo Alto Networks
Malware: Ursnif Gozi Shiotob Bebloh URLZone Pushdo Cutwail KINS Tinba Rovnix
Organizations: Palo Alto Networks Tokyo Metropolitan Police Department Japan Cybercrime Control Center
Countries: Japan Italy Spain Poland Australia Germany

Indicators of compromise

auto-extracted · verify before use · export allAll

From the original article

5 min read at unit42.paloaltonetworks.com

The infamous banking Trojan Ursnif (a. k. a Gozi) has been continuously used in attacks against Japan for more than a year.

Palo Alto Unit 42

By Kaoru Hayashi · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.

Type	Indicator	Context
sha256	0733779b99ccced9808136088e08bed6518097fd892c51c150a5d7e99b755562	fb729401085388e2142d12fac724684c5b3dcf367b645781695 Shiotob 0733779b99ccced9808136088e08bed6518097fd892c51c150a5d7e99b755562 124e6d6d3da321ad04e7f3aa9ae1b29fea2f382e8903a72ce48091cce47
sha256	08a5a1c0b53592a8f0890447d71bcec5380f104a176277512ee52c063188e151	e38b1d66191e5f201b88c920ebd4ac7450fb6eaadaf6215b64cd0af6f30 08a5a1c0b53592a8f0890447d71bcec5380f104a176277512ee52c063188e151 cbbfa84227d82360d79baf8ab4ee0f9a13d0fa7128eac72c0bd627d4dbb
sha256	111dd5576fd9c9108a801eded1ab93d21583c84cdfb86ea81fea14ae2ed8ed40	c5399a945f16080d0d8b44cceca3176ecc8e03d03e5aa2295498b7c0cf7 111dd5576fd9c9108a801eded1ab93d21583c84cdfb86ea81fea14ae2ed8ed40 3fd65bd55e4dadbf079c6a533941135b0ddf217dea16eec6ebc33f2098e
sha256	124e6d6d3da321ad04e7f3aa9ae1b29fea2f382e8903a72ce48091cce47127ce	79b99ccced9808136088e08bed6518097fd892c51c150a5d7e99b755562 124e6d6d3da321ad04e7f3aa9ae1b29fea2f382e8903a72ce48091cce47127ce 164eab81c9ef0b14b4f93f7f5b60b0111d9eb3de3131c35f2f388837e03
sha256	164eab81c9ef0b14b4f93f7f5b60b0111d9eb3de3131c35f2f388837e0309b9e	d6d3da321ad04e7f3aa9ae1b29fea2f382e8903a72ce48091cce47127ce 164eab81c9ef0b14b4f93f7f5b60b0111d9eb3de3131c35f2f388837e0309b9e 194e6644ea8c81e8e6073434f5305c48fbd22dcbfe7d911ad36a314bf61
sha256	194e6644ea8c81e8e6073434f5305c48fbd22dcbfe7d911ad36a314bf61ce301	b81c9ef0b14b4f93f7f5b60b0111d9eb3de3131c35f2f388837e0309b9e 194e6644ea8c81e8e6073434f5305c48fbd22dcbfe7d911ad36a314bf61ce301 1af5467950d5e171827936d522ae7fc47d7e92cb639d83a6d1b1e617056
sha256	1af5467950d5e171827936d522ae7fc47d7e92cb639d83a6d1b1e6170568987c	644ea8c81e8e6073434f5305c48fbd22dcbfe7d911ad36a314bf61ce301 1af5467950d5e171827936d522ae7fc47d7e92cb639d83a6d1b1e6170568987c 1ede3e09794eb4fbb5a9a67702aeca7495d7b9d12b47dc4493d5f645fa0
sha256	1cef688950b9ca01bea0ec9883ab25cebae3db169ff4fb034696868918889f93	c376d6ddfc678e7c7b3324b021edf19c896a80ab1ec7c2f36bc004ef29e 1cef688950b9ca01bea0ec9883ab25cebae3db169ff4fb034696868918889f93 26a3f192fab07bb2bffa66f028d793f4a5ca851672430d778b537c4dde8
sha256	1ede3e09794eb4fbb5a9a67702aeca7495d7b9d12b47dc4493d5f645fa04279d	67950d5e171827936d522ae7fc47d7e92cb639d83a6d1b1e6170568987c 1ede3e09794eb4fbb5a9a67702aeca7495d7b9d12b47dc4493d5f645fa04279d 2209aa1f8719cc1f1bec10c0e2c611fff44107c54754b63af8bce748a9c
sha256	1f739f3f90382fb729401085388e2142d12fac724684c5b3dcf367b645781695	7fd039bce4c7a6a163dd6ff380fdda9fd27d552fa8c66be20e3fabf6cd3 1f739f3f90382fb729401085388e2142d12fac724684c5b3dcf367b645781695 Shiotob 0733779b99ccced9808136088e08bed6518097fd892c51c150a
sha256	1f8da66ce073a08f45f724bfa31ffe2b266ada3847186018af8d381ffeaf1dac	aa70e484a3d35c1e8a1a50c96f9186f48c7aa10888b5c42b648fa5bfbfb 1f8da66ce073a08f45f724bfa31ffe2b266ada3847186018af8d381ffeaf1dac 5477e90ff3755d2807951850964a881b60158ae1f911ef2ffb4bdef32a4
sha256	2209aa1f8719cc1f1bec10c0e2c611fff44107c54754b63af8bce748a9c2ba11	e09794eb4fbb5a9a67702aeca7495d7b9d12b47dc4493d5f645fa04279d 2209aa1f8719cc1f1bec10c0e2c611fff44107c54754b63af8bce748a9c2ba11 22fe4de964db8874728d54c8327f0763383b56bb838983ac2d0ad16f9a9
sha256	22fe4de964db8874728d54c8327f0763383b56bb838983ac2d0ad16f9a9f0296	a1f8719cc1f1bec10c0e2c611fff44107c54754b63af8bce748a9c2ba11 22fe4de964db8874728d54c8327f0763383b56bb838983ac2d0ad16f9a9f0296 24af6a68330743f0ba7e152d426f16768a915d619e807b56a4b7944c780
sha256	24af6a68330743f0ba7e152d426f16768a915d619e807b56a4b7944c780fe46d	de964db8874728d54c8327f0763383b56bb838983ac2d0ad16f9a9f0296 24af6a68330743f0ba7e152d426f16768a915d619e807b56a4b7944c780fe46d 24d6ff074c68060d5bfd31c2a8784fc58033d865110f01778b6f43fb71d
sha256	24d6ff074c68060d5bfd31c2a8784fc58033d865110f01778b6f43fb71d1be82	a68330743f0ba7e152d426f16768a915d619e807b56a4b7944c780fe46d 24d6ff074c68060d5bfd31c2a8784fc58033d865110f01778b6f43fb71d1be82 25e49603ccd58159180e10cc9df9944845870d3bd6dbaa2ce2a5ad16d5d
sha256	25e49603ccd58159180e10cc9df9944845870d3bd6dbaa2ce2a5ad16d5d224b8	f074c68060d5bfd31c2a8784fc58033d865110f01778b6f43fb71d1be82 25e49603ccd58159180e10cc9df9944845870d3bd6dbaa2ce2a5ad16d5d224b8 2b7c4c4370000b258932ffe871e3cd9ec613c223ea129fd164d32070544
sha256	26a3f192fab07bb2bffa66f028d793f4a5ca851672430d778b537c4dde800d9c	88950b9ca01bea0ec9883ab25cebae3db169ff4fb034696868918889f93 26a3f192fab07bb2bffa66f028d793f4a5ca851672430d778b537c4dde800d9c 7f0359314eb3577075367df11699cafd8a5f6c36da0e58890acebbce414
sha256	28150a3e9f8d23c784923e9664086ad18aae71ef83e4a60ebfb1fd8bd5abbd80	5ced322c9aabb78983c2a40657c83ba7805320423e66b402cd20cdd57eb 28150a3e9f8d23c784923e9664086ad18aae71ef83e4a60ebfb1fd8bd5abbd80 f30838a6b53a892ae4e5231de1d2f74a2e51919a66e9e60da3de125c9bd
sha256	2b7c4c4370000b258932ffe871e3cd9ec613c223ea129fd164d32070544ee53f	603ccd58159180e10cc9df9944845870d3bd6dbaa2ce2a5ad16d5d224b8 2b7c4c4370000b258932ffe871e3cd9ec613c223ea129fd164d32070544ee53f 2d43697cacccfa10ac4fe3119a86bcc1113925f04d7b95e3297ace3ee1d
sha256	2d43697cacccfa10ac4fe3119a86bcc1113925f04d7b95e3297ace3ee1dbcb75	c4370000b258932ffe871e3cd9ec613c223ea129fd164d32070544ee53f 2d43697cacccfa10ac4fe3119a86bcc1113925f04d7b95e3297ace3ee1dbcb75 2edfc720a92bcdd2d42416ed6bb79ce84eec28a8316cb6160527627779c
sha256	2edfc720a92bcdd2d42416ed6bb79ce84eec28a8316cb6160527627779c6b4db	97cacccfa10ac4fe3119a86bcc1113925f04d7b95e3297ace3ee1dbcb75 2edfc720a92bcdd2d42416ed6bb79ce84eec28a8316cb6160527627779c6b4db 317bfbe3107ac085d1751e04202b99e2ce8a75285e5033b789de34457c7
sha256	3044a4b0cffdeaeeab425109e8cddc597e708f5025849b5d29bff35ce24f4e42	84227d82360d79baf8ab4ee0f9a13d0fa7128eac72c0bd627d4dbbb06f9 3044a4b0cffdeaeeab425109e8cddc597e708f5025849b5d29bff35ce24f4e42 3656e5ced322c9aabb78983c2a40657c83ba7805320423e66b402cd20cd
sha256	31055c7167c369313262fb0fb2bf1ac1db895d04067ed505732ccd3d5ef43b29	2fdaf4b0f7c0ea6104d2f6c942b915fad5486db2567e94342e76f943a4e 31055c7167c369313262fb0fb2bf1ac1db895d04067ed505732ccd3d5ef43b29 fde59700c02a58752cd28d6adb0389a5d69657f6f6925a0bd8ba35a1f72
sha256	317bfbe3107ac085d1751e04202b99e2ce8a75285e5033b789de34457c7ae7a7	720a92bcdd2d42416ed6bb79ce84eec28a8316cb6160527627779c6b4db 317bfbe3107ac085d1751e04202b99e2ce8a75285e5033b789de34457c7ae7a7 347430676e7811c4433d4d10d7ff5695dd34083d9f37a32f5130e29263f
sha256	347430676e7811c4433d4d10d7ff5695dd34083d9f37a32f5130e29263f3cb72	be3107ac085d1751e04202b99e2ce8a75285e5033b789de34457c7ae7a7 347430676e7811c4433d4d10d7ff5695dd34083d9f37a32f5130e29263f3cb72 3a5020bbd52ef368d98f51a9caca2b266f0f5ec7719e8159e32dd08ad80
sha256	3656e5ced322c9aabb78983c2a40657c83ba7805320423e66b402cd20cdd57eb	4b0cffdeaeeab425109e8cddc597e708f5025849b5d29bff35ce24f4e42 3656e5ced322c9aabb78983c2a40657c83ba7805320423e66b402cd20cdd57eb 28150a3e9f8d23c784923e9664086ad18aae71ef83e4a60ebfb1fd8bd5a
sha256	3a5020bbd52ef368d98f51a9caca2b266f0f5ec7719e8159e32dd08ad80e60c4	0676e7811c4433d4d10d7ff5695dd34083d9f37a32f5130e29263f3cb72 3a5020bbd52ef368d98f51a9caca2b266f0f5ec7719e8159e32dd08ad80e60c4 3a59673578576a0d1551c120f612217aa3ab1a511bb6eba03908ba3aa27
sha256	3a59673578576a0d1551c120f612217aa3ab1a511bb6eba03908ba3aa2719bf8	0bbd52ef368d98f51a9caca2b266f0f5ec7719e8159e32dd08ad80e60c4 3a59673578576a0d1551c120f612217aa3ab1a511bb6eba03908ba3aa2719bf8 3b6a2050bfd395756237a48e39007279a0ed80cb1e1cec05bbe77f813be
sha256	3af18232a9175dea624a7947e6edef6a57457bdf6d3ba0ead58856a139db2832	INS, Shiotob, Pushdo, Tinba and Andromeda Indicators Ursnif 3af18232a9175dea624a7947e6edef6a57457bdf6d3ba0ead58856a139db2832 5feeee23ecd310ed552b56c1992d5e7f6dbf4e656224a9f3073b8377076
sha256	3b6a2050bfd395756237a48e39007279a0ed80cb1e1cec05bbe77f813befb002	73578576a0d1551c120f612217aa3ab1a511bb6eba03908ba3aa2719bf8 3b6a2050bfd395756237a48e39007279a0ed80cb1e1cec05bbe77f813befb002 3e325fe43a78054dad21049abc7ea56510959eb2da5a1e21dae3fe16810
sha256	3e325fe43a78054dad21049abc7ea56510959eb2da5a1e21dae3fe168106cade	050bfd395756237a48e39007279a0ed80cb1e1cec05bbe77f813befb002 3e325fe43a78054dad21049abc7ea56510959eb2da5a1e21dae3fe168106cade 4039ab72bce95e0ec30092a12a7d6d4f8509d5a6bc05fc8e6463c9a2620
sha256	3f3bdb38e4878331de5e867a2606bd9cb9c351303af53194d72f8dc2ddd04a97	e69d48a5151d47aabd30f3056166032ef9f53e877f09bbd69053b7f4b37 3f3bdb38e4878331de5e867a2606bd9cb9c351303af53194d72f8dc2ddd04a97 88cbc2fdaf4b0f7c0ea6104d2f6c942b915fad5486db2567e94342e76f9
sha256	3fd65bd55e4dadbf079c6a533941135b0ddf217dea16eec6ebc33f2098ea6276	5576fd9c9108a801eded1ab93d21583c84cdfb86ea81fea14ae2ed8ed40 3fd65bd55e4dadbf079c6a533941135b0ddf217dea16eec6ebc33f2098ea6276 55acc2455ba3bef79840ead843cf29af239e7384f7d62246fe93fe427ed
sha256	4039ab72bce95e0ec30092a12a7d6d4f8509d5a6bc05fc8e6463c9a262060434	fe43a78054dad21049abc7ea56510959eb2da5a1e21dae3fe168106cade 4039ab72bce95e0ec30092a12a7d6d4f8509d5a6bc05fc8e6463c9a262060434 40a8deaeb8902947c6ba98ce0af62a6a487c3afcaf6e96dcda2fb27e6af
sha256	40a8deaeb8902947c6ba98ce0af62a6a487c3afcaf6e96dcda2fb27e6af9c122	b72bce95e0ec30092a12a7d6d4f8509d5a6bc05fc8e6463c9a262060434 40a8deaeb8902947c6ba98ce0af62a6a487c3afcaf6e96dcda2fb27e6af9c122 4b64a23de0d09e2f9daeef283d4582bf04b416b465c1c6863b7698eb82b
sha256	4948be38b1d66191e5f201b88c920ebd4ac7450fb6eaadaf6215b64cd0af6f30	444e8551666ddd4e13445e3a196039b9065e64ba7102d16067f40e0f412 4948be38b1d66191e5f201b88c920ebd4ac7450fb6eaadaf6215b64cd0af6f30 08a5a1c0b53592a8f0890447d71bcec5380f104a176277512ee52c06318
sha256	4b64a23de0d09e2f9daeef283d4582bf04b416b465c1c6863b7698eb82b56c4e	eaeb8902947c6ba98ce0af62a6a487c3afcaf6e96dcda2fb27e6af9c122 4b64a23de0d09e2f9daeef283d4582bf04b416b465c1c6863b7698eb82b56c4e 4ee9a7fd63daab6d756193756c3a63b2bcc3a2c04397c6126b9c6f3b1ad
sha256	4ee9a7fd63daab6d756193756c3a63b2bcc3a2c04397c6126b9c6f3b1ada0b5c	23de0d09e2f9daeef283d4582bf04b416b465c1c6863b7698eb82b56c4e 4ee9a7fd63daab6d756193756c3a63b2bcc3a2c04397c6126b9c6f3b1ada0b5c 504d71d3e1ddf4487033d6c8a5840c7eccc5babcd7f23a5587eaa07aa61
sha256	4f846222f454c773b3db1a467155e388672e20b6edacc6406a75dbf09432108c	90ff3755d2807951850964a881b60158ae1f911ef2ffb4bdef32a4d62e9 4f846222f454c773b3db1a467155e388672e20b6edacc6406a75dbf09432108c 7c8e9eb4a6b3d59d02faab21b94664ed473c346731cc28c0036c2c3e14d
sha256	504d71d3e1ddf4487033d6c8a5840c7eccc5babcd7f23a5587eaa07aa61ea148	7fd63daab6d756193756c3a63b2bcc3a2c04397c6126b9c6f3b1ada0b5c 504d71d3e1ddf4487033d6c8a5840c7eccc5babcd7f23a5587eaa07aa61ea148 5914a658c65237b9e9516313c39efffd646b6e9573315a6353375863c1d