Ursnif Malware — Reconstructing a 6-Stage Infection Chain from a PCAP

This write-up reconstructs a 6-stage Ursnif/Gozi banking trojan infection chain from a PCAP capture, detailing how the malware used .avi file extensions to disguise DLL payloads and TLS-encrypted C2 beaconing. The author extracted 10 IOCs, mapped each stage to MITRE ATT&CK techniques, and developed 5 Splunk detection rules from 2,180 packets.