Ursnif Banking Trojan Uses Stealthy Memory Execution

Cyble Research and Intelligence Labs (CRIL) reports a targeted Ursnif banking-trojan campaign against U.S. business professionals using a ZIP-delivered .lnk masquerading as a PDF to invoke certutil and decode an HTA; the HTA drops a DLL and lure PDF, the DLL decrypts and executes shellcode and a second-stage DLL in memory, leading to the in-memory load of the Ursnif core which communicates with C2 (budalixt.top) to download modules and exfiltrate data; the report includes detailed technical analysis, TTP mapping to MITRE ATT&CK, YARA rule references, and multiple IOCs (hashes and URLs).