osiris

General

Target

dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19
Size

1.2MB
Sample

240414-r1v34shc92
MD5

46418f7453541b35f5962bc93588c8d4
SHA1

f6d57ef7add3039a956dd4a86f0efafb375d5eaf
SHA256

dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19
SHA512

cb7c7acc6496155f96f357be50ff789ab5bbe668f7624592f27cd9093914026848e476ea367ca6177e66f78f2c59300b78b9ac8092d5c2e0499069a21097620b
SSDEEP

12288:u+rq0yKJ7KZeBA4DVzlzEyn2QFqTjCAjkTnV/QH7OTzId2nfpN3fXx:FW0yreAkpzP/QCAjkTmbOwYRZB

Score

10^/10

Malware Config

Targets

- Target
  
  dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19
- Size
  
  1.2MB
- MD5
  
  46418f7453541b35f5962bc93588c8d4
- SHA1
  
  f6d57ef7add3039a956dd4a86f0efafb375d5eaf
- SHA256
  
  dfe468bdad97b15c8ede2105a66c389b41f79e54de10747d6713140a70883a19
- SHA512
  
  cb7c7acc6496155f96f357be50ff789ab5bbe668f7624592f27cd9093914026848e476ea367ca6177e66f78f2c59300b78b9ac8092d5c2e0499069a21097620b
- SSDEEP
  
  12288:u+rq0yKJ7KZeBA4DVzlzEyn2QFqTjCAjkTnV/QH7OTzId2nfpN3fXx:FW0yreAkpzP/QCAjkTmbOwYRZB
Score

10^/10

osiris banker botnet
- Osiris
  banker botnet osiris
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Proxy

1

T1090

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Uses Tor communications

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4