osiris | 3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887 | Triage

Resubmissions

22-09-2021 14:16

210922-rk974afedl 10

Sharing

General

Target

3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
Size

566KB
Sample

210922-rk974afedl
MD5

7e8b9cf70707293f8950b2151a3c16f4
SHA1

c925e491311dc75e2c8a7c05d7deb608c95b4e51
SHA256

3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
SHA512

6059abc60ecd8f67dc4d80a189aa9b8631204dc7b38936f3ee0735eb3030ceefb08fba14a492978afe2191fd35ac17c705317dc5c83a216bce23b0b58533630c

Score

10^/10

osiris banker botnet persistence

Malware Config

Targets

- Target
  
  3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
- Size
  
  566KB
- MD5
  
  7e8b9cf70707293f8950b2151a3c16f4
- SHA1
  
  c925e491311dc75e2c8a7c05d7deb608c95b4e51
- SHA256
  
  3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887
- SHA512
  
  6059abc60ecd8f67dc4d80a189aa9b8631204dc7b38936f3ee0735eb3030ceefb08fba14a492978afe2191fd35ac17c705317dc5c83a216bce23b0b58533630c
Score

10^/10

osiris banker botnet persistence
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Connection Proxy

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnetpersistence

behavioral2

osirisbankerbotnetpersistence