Overview

overview

10

Static

static

3

3e6612264a...87.exe

windows7-x64

10

3e6612264a...87.exe

windows10-1703-x64

10

3e6612264a...87.exe

windows10-2004-x64

10

3e6612264a...87.exe

windows11-21h2-x64

7

Resubmissions

22-09-2021 14:16

210922-rk974afedl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887

  • Size

    566KB

  • Sample

    240414-r6yfeshd62

  • MD5

    7e8b9cf70707293f8950b2151a3c16f4

  • SHA1

    c925e491311dc75e2c8a7c05d7deb608c95b4e51

  • SHA256

    3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887

  • SHA512

    6059abc60ecd8f67dc4d80a189aa9b8631204dc7b38936f3ee0735eb3030ceefb08fba14a492978afe2191fd35ac17c705317dc5c83a216bce23b0b58533630c

  • SSDEEP

    12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvW0:pjOMtd1a/yl3KOjb

Score
10/10
osirisbankerbotnetpersistence

Malware Config

Targets

    • Target

      3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887

    • Size

      566KB

    • MD5

      7e8b9cf70707293f8950b2151a3c16f4

    • SHA1

      c925e491311dc75e2c8a7c05d7deb608c95b4e51

    • SHA256

      3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887

    • SHA512

      6059abc60ecd8f67dc4d80a189aa9b8631204dc7b38936f3ee0735eb3030ceefb08fba14a492978afe2191fd35ac17c705317dc5c83a216bce23b0b58533630c

    • SSDEEP

      12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvW0:pjOMtd1a/yl3KOjb

    Score
    10/10
    osirisbankerbotnetpersistence

    • Osiris

      bankerbotnetosiris

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks