Trojan.Spy.Ursnif is designed to stealthily poke into the e-banking account and report back to the base. Trojan Trojan is able to clear cookies for the default browser and to take screenshots of the user logging in those bank websites and sending them to a remote server. Trojan.Spi.F also downloads an encrypted buffer to a memory location, which is actually a list of bank websites URLs, as well as some JavaScript code that is used to steal passwords, user names and user names.”]
Source: https://www.bitdefender.com/blog/hotforsecurity/spying-trojans-equal-financial-loss/