{
  "family": "krbanker",
  "sample_count": 21,
  "category": "trojan",
  "description": "KRBanker (cataloged across global antimalware intelligence under signatures including Trojan:Win32/KRBanker, Trojan:Win32/KRBanker.A, and TrojanSpy:Win32/KRBanker) is a specialized South Korean banking trojan and financial fraud threat active since 2014. Distributed primarily through compromised Korean software update servers, malicious drive-by download frames, and weaponized spearphishing campaigns, KRBanker manipulates local domain name resolution and browser execution. It alters the local hosts file (%SystemRoot%\\System32\\drivers\\etc\\hosts) and modifies DNS client settings to redirect traffic intended for major South Korean financial institutions, portals, and banking services toward credential-harvesting phishing replicas. KRBanker actively targets security software mandated by Korean banking portals (such as AhnLab Safe Transaction and nProtect Netizen), attempting to terminate or hook their execution modules, while capturing personal identification numbers, resident registration numbers, and banking certificates.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/KRBanker",
    "Trojan:Win32/KRBanker.A",
    "TrojanSpy:Win32/KRBanker",
    "Win32/KRBanker",
    "Banker.KRBanker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/KRBanker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "KRBanker is a banking trojan focused on South Korean financial targets, hijacking domain resolution to steal online banking credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does KRBanker redirect banking traffic to fraudulent portals?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies the Windows local hosts file and overrides DNS server settings to point financial domains to fake server IPs."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures are disabled by KRBanker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It attempts to terminate and hook Korean online banking security utilities including AhnLab Safe Transaction and nProtect."
      }
    },
    {
      "@type": "Question",
      "name": "How is KRBanker distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads through compromised local software update channels, malicious drive-by web downloads, and targeted spearphishing."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken after a KRBanker compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the workstation, restore the original hosts file, reset DNS configurations, purge malware binaries, and revoke banking certificates."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1565.001",
    "T1056.001",
    "T1555.003",
    "T1547.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/KRBanker",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/KRBanker"
    },
    {
      "name": "AhnLab Security Emergency Response Center (ASEC) - KRBanker Analysis",
      "url": "https://asec.ahnlab.com/en/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Banker.Win32.KRBanker",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/banker.win32.krbanker"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1565.001",
      "name": "Stored Data Manipulation: Hosts File",
      "tactic": "Impact"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from network connections immediately to stop credential exfiltration.",
    "Inspect and reset %SystemRoot%\\System32\\drivers\\etc\\hosts to restore default domain mappings.",
    "Verify network adapter DNS settings to ensure rogue DNS server addresses are removed.",
    "Kill unauthorized processes and delete trojan binaries in %APPDATA% and %TEMP%.",
    "Notify financial institutions immediately to freeze compromised accounts and revoke stored digital banking certificates."
  ],
  "what_to_avoid": [
    "Do not input banking passwords or digital certificate credentials on an unverified workstation.",
    "Do not ignore browser SSL/TLS certificate warnings when accessing banking websites."
  ],
  "target_industries": [
    "Banking & Financial Services",
    "Consumer Endpoints (South Korea)",
    "Commercial Retail"
  ],
  "target_geographies": [
    "South Korea",
    "East Asia"
  ],
  "threat_actors": [
    "Financially Motivated Cybercrime Groups"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "credential_access",
    "collection"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud, Account Takeover & Banking Theft",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}