Overview

overview

10

Static

static

3

cc629e5d6f...3d.exe

windows7-x64

10

cc629e5d6f...3d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc629e5d6fabb0da8f46ecb5d667113d.bin

  • Size

    3.1MB

  • Sample

    240317-eq86rsea24

  • MD5

    cc629e5d6fabb0da8f46ecb5d667113d

  • SHA1

    ce1084782c077756fb43a1056cfcfdd80182f54e

  • SHA256

    c0503c54556ba129ef04f224cec3c985e7d17f7e39a4574cbd553a67902ec689

  • SHA512

    c54ca9ed01b007fc4abc0d72c77253ac2d8802882841a43226764b1fd46e4a1873158d04b396c3b82381fa806abc27cfb6b7778668c656afa53afc6d7c539a4a

  • SSDEEP

    49152:jitOd4k7ydepSSPIZDscC+QZKDVdfu315:jiK4IIZYfZKDVQF5

Score
10/10
osirisbankerbotnet

Malware Config

Targets

    • Target

      cc629e5d6fabb0da8f46ecb5d667113d.bin

    • Size

      3.1MB

    • MD5

      cc629e5d6fabb0da8f46ecb5d667113d

    • SHA1

      ce1084782c077756fb43a1056cfcfdd80182f54e

    • SHA256

      c0503c54556ba129ef04f224cec3c985e7d17f7e39a4574cbd553a67902ec689

    • SHA512

      c54ca9ed01b007fc4abc0d72c77253ac2d8802882841a43226764b1fd46e4a1873158d04b396c3b82381fa806abc27cfb6b7778668c656afa53afc6d7c539a4a

    • SSDEEP

      49152:jitOd4k7ydepSSPIZDscC+QZKDVdfu315:jiK4IIZYfZKDVQF5

    Score
    10/10
    osirisbankerbotnet

    • Osiris

      bankerbotnetosiris

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks