osiris | 0905e3a59d5e98d625d3d70d0148b1c18523d230f4e6ef5ef0d9147e25c8f506 | Triage

Sharing

General

Target

0905e3a59d5e98d625d3d70d0148b1c18523d230f4e6ef5ef0d9147e25c8f506
Size

434KB
Sample

210922-qned6afdck
MD5

b5c160ef4bae5e1103f0c32a133de542
SHA1

ff2e659ac88514fdeb2a884f1ded6b1bd5932b5f
SHA256

0905e3a59d5e98d625d3d70d0148b1c18523d230f4e6ef5ef0d9147e25c8f506
SHA512

bc5c8fbd61c935dd66167f0ab4ceee56804401513656039c3c5a97feaef0fb0be5c5b7ae9348572869b987633506fb4b770e647712aa40591e571946269137ea

Score

10^/10

osiris banker botnet

Malware Config

Targets

- Target
  
  0905e3a59d5e98d625d3d70d0148b1c18523d230f4e6ef5ef0d9147e25c8f506
- Size
  
  434KB
- MD5
  
  b5c160ef4bae5e1103f0c32a133de542
- SHA1
  
  ff2e659ac88514fdeb2a884f1ded6b1bd5932b5f
- SHA256
  
  0905e3a59d5e98d625d3d70d0148b1c18523d230f4e6ef5ef0d9147e25c8f506
- SHA512
  
  bc5c8fbd61c935dd66167f0ab4ceee56804401513656039c3c5a97feaef0fb0be5c5b7ae9348572869b987633506fb4b770e647712aa40591e571946269137ea
Score

10^/10

osiris banker botnet
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

Impact

Tasks

static1

behavioral1

osirisbankerbotnet

behavioral2

osirisbankerbotnet