osiris | 29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674 | Triage

Sharing

General

Target

29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674
Size

478KB
Sample

220524-dq7ghahagm
MD5

a6c3d82792c4ce7dc0695b3c013a27d3
SHA1

ee4319f916330ff685b2d4ccd458a1baacf71dcf
SHA256

29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674
SHA512

8584e0a1420ccb9b16fa4b983629d9920576b1f40268c8479fbecd00470b0bcd1c6a850b76684dc20fa3afe75d4693b968d3a45843e18f550e026468382241a9

Score

10^/10

osiris banker botnet

Malware Config

Targets

- Target
  
  29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674
- Size
  
  478KB
- MD5
  
  a6c3d82792c4ce7dc0695b3c013a27d3
- SHA1
  
  ee4319f916330ff685b2d4ccd458a1baacf71dcf
- SHA256
  
  29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674
- SHA512
  
  8584e0a1420ccb9b16fa4b983629d9920576b1f40268c8479fbecd00470b0bcd1c6a850b76684dc20fa3afe75d4693b968d3a45843e18f550e026468382241a9
Score

10^/10

osiris banker botnet
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnet

behavioral2

osirisbankerbotnet