Overview

overview

10

Static

static

31648a90be...cd.exe

windows7_x64

10

31648a90be...cd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31648a90be32f667e95884f91f95a1e52dd3404fd4b0b282baac1a6a28d8a8cd

  • Size

    786KB

  • Sample

    220319-nn95qaghd5

  • MD5

    5a67e5c4236e16b4ed8cf12576946eb0

  • SHA1

    53e9d58c1804400da85ff90012bd11cd38a1abfc

  • SHA256

    31648a90be32f667e95884f91f95a1e52dd3404fd4b0b282baac1a6a28d8a8cd

  • SHA512

    814f03fcb85ace0e89428206c439f38e4895b0a81b5dffc01f1d1d464b1bb3b34b61d18679b364b5dd0bfe57b6e1d00d50e4e2c22aba6886fd8bead45c34c0f7

Score
10/10
osirisbankerbotnet

Malware Config

Targets

    • Target

      31648a90be32f667e95884f91f95a1e52dd3404fd4b0b282baac1a6a28d8a8cd

    • Size

      786KB

    • MD5

      5a67e5c4236e16b4ed8cf12576946eb0

    • SHA1

      53e9d58c1804400da85ff90012bd11cd38a1abfc

    • SHA256

      31648a90be32f667e95884f91f95a1e52dd3404fd4b0b282baac1a6a28d8a8cd

    • SHA512

      814f03fcb85ace0e89428206c439f38e4895b0a81b5dffc01f1d1d464b1bb3b34b61d18679b364b5dd0bfe57b6e1d00d50e4e2c22aba6886fd8bead45c34c0f7

    Score
    10/10
    osirisbankerbotnet

    • Osiris

      bankerbotnetosiris

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1
T1090

Impact

Tasks