osiris | 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d | Triage

Resubmissions

13-09-2021 08:21

210913-j9gyvagddm 10

Sharing

General

Target

4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d
Size

566KB
Sample

210913-j9gyvagddm
MD5

e08abfaa3f43ee68221fe4c21b9a0ea6
SHA1

5092275c94bb50bfe326ffbe22a56aab5746b739
SHA256

4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d
SHA512

dc7181f47541ad3e323baba9f763a5a0e315450b59b04d894835a25f5c074e2ab8fdd4170c83ae7c5c025861a206e553bcc77169bb76eb32fd098685954f57c9

Score

10^/10

osiris banker botnet persistence

Malware Config

Targets

- Target
  
  4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d
- Size
  
  566KB
- MD5
  
  e08abfaa3f43ee68221fe4c21b9a0ea6
- SHA1
  
  5092275c94bb50bfe326ffbe22a56aab5746b739
- SHA256
  
  4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d
- SHA512
  
  dc7181f47541ad3e323baba9f763a5a0e315450b59b04d894835a25f5c074e2ab8fdd4170c83ae7c5c025861a206e553bcc77169bb76eb32fd098685954f57c9
Score

10^/10

osiris banker botnet persistence
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Connection Proxy

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnetpersistence

behavioral2

osirisbankerbotnetpersistence