Overview

overview

10

Static

static

3

07de8d93ec...ae.exe

windows7-x64

10

07de8d93ec...ae.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07de8d93ec7190afee1eb569dce09bae

  • Size

    3.1MB

  • Sample

    231230-aa77badaan

  • MD5

    07de8d93ec7190afee1eb569dce09bae

  • SHA1

    ef0b072fcf7f00184471589a6e4a0d3bd09b9553

  • SHA256

    12dc9ca2e6b5e7c547ebd3814953c4e2aa0d1eb726877151b09494ab6a0c07bd

  • SHA512

    a8d226bd9c8c0a8d6f856a9ef5ef8d235ca1e1c67c250d0f0bd043ae400f61b3dd7f1032c3278178d783edec343ba5a3870f1b753079f0d16a7955cdb57670ac

  • SSDEEP

    49152:nitOd4k7ydepSSPIZDscC+QZKDVdfu31W:niK4IIZYfZKDVQFW

Score
10/10
osirisbankerbotnet

Malware Config

Targets

    • Target

      07de8d93ec7190afee1eb569dce09bae

    • Size

      3.1MB

    • MD5

      07de8d93ec7190afee1eb569dce09bae

    • SHA1

      ef0b072fcf7f00184471589a6e4a0d3bd09b9553

    • SHA256

      12dc9ca2e6b5e7c547ebd3814953c4e2aa0d1eb726877151b09494ab6a0c07bd

    • SHA512

      a8d226bd9c8c0a8d6f856a9ef5ef8d235ca1e1c67c250d0f0bd043ae400f61b3dd7f1032c3278178d783edec343ba5a3870f1b753079f0d16a7955cdb57670ac

    • SSDEEP

      49152:nitOd4k7ydepSSPIZDscC+QZKDVdfu31W:niK4IIZYfZKDVQFW

    Score
    10/10
    osirisbankerbotnet

    • Osiris

      bankerbotnetosiris

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks