osiris | 29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674 | Triage

Sharing

General

Target

29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674
Size

478KB
Sample

220524-dq7ghahagm
MD5

a6c3d82792c4ce7dc0695b3c013a27d3
SHA1

ee4319f916330ff685b2d4ccd458a1baacf71dcf
SHA256

29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674
SHA512

8584e0a1420ccb9b16fa4b983629d9920576b1f40268c8479fbecd00470b0bcd1c6a850b76684dc20fa3afe75d4693b968d3a45843e18f550e026468382241a9

Score

10^/10

osiris banker botnet

Malware Config

Targets

- Target
  
  29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674
- Size
  
  478KB
- MD5
  
  a6c3d82792c4ce7dc0695b3c013a27d3
- SHA1
  
  ee4319f916330ff685b2d4ccd458a1baacf71dcf
- SHA256
  
  29c9272012b3b7ec9d72f112fe1eae5a119441f3da03d6870458176525485674
- SHA512
  
  8584e0a1420ccb9b16fa4b983629d9920576b1f40268c8479fbecd00470b0bcd1c6a850b76684dc20fa3afe75d4693b968d3a45843e18f550e026468382241a9
Score

10^/10

osiris banker botnet
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

Impact

Tasks

static1

behavioral1

osirisbankerbotnet

behavioral2

osirisbankerbotnet