osiris | dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f | Triage

Sharing

General

Target

dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f
Size

484KB
Sample

201105-c31ghfvls2
MD5

b988afbb1df5f268d64a2ef604c92cdf
SHA1

b9320b32b14219e2829eaa6a69b046e6d68b39dd
SHA256

dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f
SHA512

ff4d78db6deac88a8094e4921bc4c8bf8a245b97e4e7c2e3c6f9855b900f4f667980e4543ebb53842778405841e2b575d414c05bc893211c1555cc0cd64e51f5

Score

10^/10

osiris banker botnet spyware

Malware Config

Targets

- Target
  
  dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f
- Size
  
  484KB
- MD5
  
  b988afbb1df5f268d64a2ef604c92cdf
- SHA1
  
  b9320b32b14219e2829eaa6a69b046e6d68b39dd
- SHA256
  
  dfb2cb14a2f6a3281514226cec06bb2bb99e9ebbeb583a9b6f80ec8b4d6fe15f
- SHA512
  
  ff4d78db6deac88a8094e4921bc4c8bf8a245b97e4e7c2e3c6f9855b900f4f667980e4543ebb53842778405841e2b575d414c05bc893211c1555cc0cd64e51f5
Score

10^/10

osiris banker botnet spyware
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnetspyware

behavioral2

osirisbankerbotnetspyware