{
  "family": "corebot",
  "sample_count": 7,
  "category": "trojan",
  "description": "Trojan:Win32/Corebot is a highly sophisticated, modular **Banking Trojan** and **Infostealer**. Originally discovered in 2015 acting as a generic credential stealer, Corebot rapidly evolved, integrating a massive web-inject plugin that allowed it to specifically target online banking portals, intercept two-factor authentication (2FA), and steal financial data in real-time. Its highly modular architecture means the botmaster can deploy custom plugins to adapt to new security measures instantly.<br><br><b>Understanding the Corebot Threat</b><br>To an end-user, Corebot operates invisibly. When they attempt to log into their bank, the website looks perfectly normal, but the trojan is actively manipulating the HTML content (Web-Injects) to harvest credentials. For a security operations center (SOC), Corebot represents a critical, high-severity breach. Its modular nature (`T1129`) means it can download secondary modules to act as a point-of-sale (POS) scraper, a cryptocurrency wallet thief, or a VNC backdoor.<br><br><b>Execution and Web-Inject Mechanics</b><br>Corebot is primarily distributed via highly targeted spear-phishing campaigns or exploit kits (`T1189`). Upon execution (`T1204.002`), it establishes persistence via Registry Run keys (`T1547.001`). Its core functionality relies on advanced process injection (`T1055.001`). It injects its malicious DLL into all active web browsers (`chrome.exe`, `iexplore.exe`, `firefox.exe`). Once injected, it hooks into the browser's networking APIs (like `HttpSendRequest`). When the user visits a targeted banking URL, Corebot intercepts the traffic *before* it is encrypted via SSL/TLS (`T1185`). It then uses its Web-Inject configuration file to modify the DOM of the banking page, presenting the user with fake login forms or requests for 2FA tokens, routing the stolen data directly to the C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is catastrophic financial fraud, credential theft, and total compromise of the user's digital identity. Host-based IoCs include EDR alerts for DLL injection into browser processes and the presence of hidden, randomly named directories in `%AppData%` containing encrypted configuration files. Network IoCs include encrypted C2 traffic utilizing custom domain generation algorithms (DGAs).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Corebot and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Corebot is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Corebot establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Corebot typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Corebot compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Corebot should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Corebot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Corebot frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Corebot across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Corebot by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1129",
    "T1185",
    "T1055.001",
    "T1552.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Browser Web-Injects)",
      "tactic": "Collection"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1129",
      "name": "Shared Modules (Modular plugin architecture)",
      "tactic": "Execution"
    },
    {
      "id": "T1552.001",
      "name": "Credentials In Files (Stealing stored browser passwords)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent the exfiltration of credentials and sever the C2 connection.",
    "Reset all passwords for any account accessed from the infected endpoint, prioritizing financial institutions, corporate VPNs, and email accounts.",
    "Capture a live memory image (RAM dump) to extract the injected Corebot modules and decrypt its web-inject configuration file to determine which banks were targeted.",
    "Wipe the infected system entirely and restore from a known-clean baseline image."
  ],
  "what_to_avoid": [
    "Do not assume changing passwords on the infected machine is sufficient; the trojan will simply intercept the new passwords in real-time.",
    "Avoid relying on standard antivirus removal; banking trojans deeply hook into the OS and often leave persistent backdoors if not properly wiped."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}