osiris | 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664 | Triage

Resubmissions

13-09-2021 08:08

210913-j1qvdsdch3 10

Sharing

General

Target

4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664
Size

1.2MB
Sample

210913-j1qvdsdch3
MD5

3719c2d7abe621d208c853cc425861d2
SHA1

3f317891a950a1a5e01b7e10715f8d62e5cf0f1f
SHA256

4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664
SHA512

d43c7487903a043cdd73fe3de3cdd87f9fe40277cdad55356061f6771b76f427049d5354b9c8f308badc946f451070d281d0421e9f8623d6922e7c59a10ae449

Score

10^/10

osiris banker botnet

Malware Config

Targets

- Target
  
  4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664
- Size
  
  1.2MB
- MD5
  
  3719c2d7abe621d208c853cc425861d2
- SHA1
  
  3f317891a950a1a5e01b7e10715f8d62e5cf0f1f
- SHA256
  
  4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664
- SHA512
  
  d43c7487903a043cdd73fe3de3cdd87f9fe40277cdad55356061f6771b76f427049d5354b9c8f308badc946f451070d281d0421e9f8623d6922e7c59a10ae449
Score

10^/10

osiris banker botnet
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnet

behavioral2

osirisbankerbotnet