osiris

General

Target

FickerStealer.exe
Size

307KB
Sample

210128-8g5r5m8pj2
MD5

1c213dbc2e5f8646d4c30586b7bcb3d8
SHA1

7a7c24e9bde5666de8763232d9ffa012fe9d18cd
SHA256

90929f4e6bd28d6a197fef323930502ac1a3dcc9de8d4dba02dc6702fd570e14
SHA512

e4b5bf282c771e1ce7152fabd5a44ecd094d5a6b0a61c26d0e25f9df15b55a6efaeaeca6a4f52a84d8d5859b6d3d2e8f15280f619edbc7c5ac4321d2359067da

Score

10^/10

Malware Config

Targets

- Target
  
  FickerStealer.exe
- Size
  
  307KB
- MD5
  
  1c213dbc2e5f8646d4c30586b7bcb3d8
- SHA1
  
  7a7c24e9bde5666de8763232d9ffa012fe9d18cd
- SHA256
  
  90929f4e6bd28d6a197fef323930502ac1a3dcc9de8d4dba02dc6702fd570e14
- SHA512
  
  e4b5bf282c771e1ce7152fabd5a44ecd094d5a6b0a61c26d0e25f9df15b55a6efaeaeca6a4f52a84d8d5859b6d3d2e8f15280f619edbc7c5ac4321d2359067da
Score

10^/10

osiris banker botnet discovery evasion ransomware spyware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- JavaScript code in executable
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
- Enumerates physical storage devices
  Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2