Overview

overview

10

Static

static

3

d03ecbfc77...bd.exe

windows7-x64

10

d03ecbfc77...bd.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    d03ecbfc77f1471f17abc928471697bd

  • Size

    3.1MB

  • Sample

    240317-hzfglahc5t

  • MD5

    d03ecbfc77f1471f17abc928471697bd

  • SHA1

    3a7524c1eee3bdee586d6fd1f23a67b7dcd57978

  • SHA256

    d538d386cc52bf444e5111763723e06687de7b9607273402b97c676322c72657

  • SHA512

    783847bc4d08e3d84765e177172a8cea7e57e5320e66f2bb67988a9223923994a059900e39d9e97d5bf19f3b29d4ba42dcd38c3105fcc7f5f5fa144322e06029

  • SSDEEP

    49152:fitOd4k7ydepSSPIZDscC+QZKDVdfu31/:fiK4IIZYfZKDVQF/

Score
10/10
osirisbankerbotnet

Malware Config

Targets

    • Target

      d03ecbfc77f1471f17abc928471697bd

    • Size

      3.1MB

    • MD5

      d03ecbfc77f1471f17abc928471697bd

    • SHA1

      3a7524c1eee3bdee586d6fd1f23a67b7dcd57978

    • SHA256

      d538d386cc52bf444e5111763723e06687de7b9607273402b97c676322c72657

    • SHA512

      783847bc4d08e3d84765e177172a8cea7e57e5320e66f2bb67988a9223923994a059900e39d9e97d5bf19f3b29d4ba42dcd38c3105fcc7f5f5fa144322e06029

    • SSDEEP

      49152:fitOd4k7ydepSSPIZDscC+QZKDVdfu31/:fiK4IIZYfZKDVQF/

    Score
    10/10
    osirisbankerbotnet

    • Osiris

      bankerbotnetosiris

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks