osiris | dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19 | Triage

Resubmissions

13-09-2021 07:53

210913-jqz1badce3 10

Sharing

General

Target

dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19
Size

1.2MB
Sample

210913-jqz1badce3
MD5

46418f7453541b35f5962bc93588c8d4
SHA1

f6d57ef7add3039a956dd4a86f0efafb375d5eaf
SHA256

dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19
SHA512

cb7c7acc6496155f96f357be50ff789ab5bbe668f7624592f27cd9093914026848e476ea367ca6177e66f78f2c59300b78b9ac8092d5c2e0499069a21097620b

Score

10^/10

osiris banker botnet

Malware Config

Targets

- Target
  
  dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19
- Size
  
  1.2MB
- MD5
  
  46418f7453541b35f5962bc93588c8d4
- SHA1
  
  f6d57ef7add3039a956dd4a86f0efafb375d5eaf
- SHA256
  
  dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19
- SHA512
  
  cb7c7acc6496155f96f357be50ff789ab5bbe668f7624592f27cd9093914026848e476ea367ca6177e66f78f2c59300b78b9ac8092d5c2e0499069a21097620b
Score

10^/10

osiris banker botnet
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnet

behavioral2

osirisbankerbotnet