osiris | 1897bc959e07da3429106dff038d6b63a6343e793f91dceadff499e8d29bf472 | Triage

Resubmissions

13-09-2021 07:48

210913-jm5fmadca3 10

Sharing

General

Target

1897bc959e07da3429106dff038d6b63a6343e793f91dceadff499e8d29bf472
Size

1.2MB
Sample

210913-jm5fmadca3
MD5

38df59cb1b647416d7a2dd6a10a7d87f
SHA1

a9c130b1a876b2bf44cf65261731309b5de58bc1
SHA256

1897bc959e07da3429106dff038d6b63a6343e793f91dceadff499e8d29bf472
SHA512

db86988b3e20b28329187ef0e773de5cd5fe2c89d677cea5773893124d8d7186036f4c36b02b43e60220e508597d8388a87842b93341b9d39edfbaf86deb2cda

Score

10^/10

osiris banker botnet

Malware Config

Targets

- Target
  
  1897bc959e07da3429106dff038d6b63a6343e793f91dceadff499e8d29bf472
- Size
  
  1.2MB
- MD5
  
  38df59cb1b647416d7a2dd6a10a7d87f
- SHA1
  
  a9c130b1a876b2bf44cf65261731309b5de58bc1
- SHA256
  
  1897bc959e07da3429106dff038d6b63a6343e793f91dceadff499e8d29bf472
- SHA512
  
  db86988b3e20b28329187ef0e773de5cd5fe2c89d677cea5773893124d8d7186036f4c36b02b43e60220e508597d8388a87842b93341b9d39edfbaf86deb2cda
Score

10^/10

osiris banker botnet
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnet

behavioral2

osirisbankerbotnet