Overview

overview

10

Static

static

3

4f0784440b...7d.exe

windows7-x64

10

4f0784440b...7d.exe

windows10-1703-x64

10

4f0784440b...7d.exe

windows10-2004-x64

10

4f0784440b...7d.exe

windows11-21h2-x64

10

Resubmissions

13-09-2021 08:21

210913-j9gyvagddm 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d

  • Size

    566KB

  • Sample

    240414-rzpvpshc75

  • MD5

    e08abfaa3f43ee68221fe4c21b9a0ea6

  • SHA1

    5092275c94bb50bfe326ffbe22a56aab5746b739

  • SHA256

    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d

  • SHA512

    dc7181f47541ad3e323baba9f763a5a0e315450b59b04d894835a25f5c074e2ab8fdd4170c83ae7c5c025861a206e553bcc77169bb76eb32fd098685954f57c9

  • SSDEEP

    12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvWG:pjOMtd1a/yl3KOjj

Score
10/10
osirisbankerbotnetpersistence

Malware Config

Targets

    • Target

      4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d

    • Size

      566KB

    • MD5

      e08abfaa3f43ee68221fe4c21b9a0ea6

    • SHA1

      5092275c94bb50bfe326ffbe22a56aab5746b739

    • SHA256

      4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d

    • SHA512

      dc7181f47541ad3e323baba9f763a5a0e315450b59b04d894835a25f5c074e2ab8fdd4170c83ae7c5c025861a206e553bcc77169bb76eb32fd098685954f57c9

    • SSDEEP

      12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvWG:pjOMtd1a/yl3KOjj

    Score
    10/10
    osirisbankerbotnetpersistence

    • Osiris

      bankerbotnetosiris

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks