osiris | 6c5dac9043b2f112543f3eca6503d4bcc70d762b47d75dcb85f9767c603de56f | Triage

Sharing

General

Target

6c5dac9043b2f112543f3eca6503d4bcc70d762b47d75dcb85f9767c603de56f
Size

561KB
Sample

221130-wgxvtaeh8w
MD5

9c73603313f6aadc2d0819d0512323b9
SHA1

9f245045d0ed54ad70e2e68042303e0b96aec6c6
SHA256

6c5dac9043b2f112543f3eca6503d4bcc70d762b47d75dcb85f9767c603de56f
SHA512

9431e42f14b60d4eb69bb47b75a96b657251752f6faedf616659257ad4cc3f9b07a305b51a2a56455d18e36d2b87317a357eed739e02c09d0470e55923e8240c
SSDEEP

12288:kW7+Efb8ddrxs7Y/wwBQTtGk5pIrD9q0RVwVSakQZ1DEmam12ZvaY4VXaFZ:kW7+Efb8ddrxs7Y/wwBQTtLOD9fRVw8n

Score

10^/10

osiris banker botnet persistence

Malware Config

Targets

- Target
  
  6c5dac9043b2f112543f3eca6503d4bcc70d762b47d75dcb85f9767c603de56f
- Size
  
  561KB
- MD5
  
  9c73603313f6aadc2d0819d0512323b9
- SHA1
  
  9f245045d0ed54ad70e2e68042303e0b96aec6c6
- SHA256
  
  6c5dac9043b2f112543f3eca6503d4bcc70d762b47d75dcb85f9767c603de56f
- SHA512
  
  9431e42f14b60d4eb69bb47b75a96b657251752f6faedf616659257ad4cc3f9b07a305b51a2a56455d18e36d2b87317a357eed739e02c09d0470e55923e8240c
- SSDEEP
  
  12288:kW7+Efb8ddrxs7Y/wwBQTtGk5pIrD9q0RVwVSakQZ1DEmam12ZvaY4VXaFZ:kW7+Efb8ddrxs7Y/wwBQTtLOD9fRVw8n
Score

10^/10

osiris banker botnet persistence
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

Impact

Tasks

static1

behavioral1

behavioral2

osirisbankerbotnetpersistence