{
  "family": "papras",
  "sample_count": 15,
  "category": "trojan",
  "description": "Trojan:Win32/Papras is a pervasive banking trojan and botnet component primarily designed for financial fraud, credential harvesting, and the facilitation of Distributed Denial of Service (DDoS) attacks. It heavily leverages Man-in-the-Browser (MitB) techniques to compromise online banking sessions.<br><br><b>Understanding Papras</b><br>To an end-user, a Papras infection is invisible until unauthorized financial transactions occur or the machine's performance degrades heavily during a DDoS campaign. For a threat intelligence analyst, Papras represents a highly organized cybercriminal operation. Once infected, the endpoint becomes a node in the Papras botnet, awaiting commands from a centralized Command and Control (C2) server to either steal local data, inject malicious scripts into banking websites, or participate in coordinated network floods.<br><br><b>Execution, MitB, and Botnet Operations</b><br>Papras is typically distributed via spam campaigns with weaponized attachments or through exploit kits (`T1189`). Upon execution, it achieves persistence by modifying the Registry Run keys or creating scheduled tasks (`T1547.001`). Its primary offensive capability is Process Injection (`T1055`); it injects its core DLLs into web browser processes (`iexplore.exe`, `chrome.exe`). From this privileged position, it utilizes Man-in-the-Browser (`T1185`) techniques. When the user navigates to a targeted banking URL, Papras intercepts the browser API calls, injecting malicious HTML/JavaScript (`T1111`) into the page to steal login credentials, intercept 2FA codes, and silently alter transaction details. Furthermore, the C2 server can instruct the infected host to launch UDP or SYN floods against specific targets (`T1498`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial fraud, credential compromise, and the consumption of corporate network bandwidth during DDoS events. EDR platforms must alert on unsigned DLLs injected into browser processes and the hooking of browser APIs. Network logs will reveal sustained beaconing to known Papras C2 infrastructure and sudden spikes in outbound UDP/SYN traffic.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1111",
    "T1185",
    "T1105",
    "T1498",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Man-in-the-Browser",
      "tactic": "Collection"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; the attacker possesses real-time capability to intercept web traffic and manipulate banking sessions.",
    "Initiate an immediate password reset for all financial, corporate, and personal accounts accessed from the infected machine, utilizing a clean device.",
    "Capture a forensic memory image (RAM dump) to extract the decrypted C2 addresses and the specific web inject configuration files (target lists).",
    "Perform a clean OS rebuild, as banking trojans often establish deep, redundant persistence mechanisms that are difficult to fully eradicate."
  ],
  "what_to_avoid": [
    "Do not allow the user to continue accessing financial portals while 'monitoring' the threat; the MitB capability intercepts traffic before encryption.",
    "Avoid ignoring sudden spikes in outbound network traffic, as the infected machine may be actively participating in a DDoS extortion campaign."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}