Overview

overview

10

Static

static

3

5e24087700...a0.exe

windows10-1703-x64

10

5e24087700...a0.exe

windows7-x64

10

5e24087700...a0.exe

windows10-1703-x64

7

5e24087700...a0.exe

windows10-2004-x64

10

5e24087700...a0.exe

windows11-21h2-x64

7

Resubmissions

18-04-2024 05:06

240418-frk11adc2x 10

18-04-2024 05:06

240418-frg94sdc2v 10

18-04-2024 05:06

240418-frd8fsdb9y 10

18-04-2024 05:06

240418-frdlxsbh73 10

18-04-2024 05:06

240418-frda6adb9x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0

  • Size

    527KB

  • Sample

    240418-frd8fsdb9y

  • MD5

    5764f48fdd3277b92114e60010f14fde

  • SHA1

    759ca2314be4f0fa951ac4d410f1db79b594dc78

  • SHA256

    5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0

  • SHA512

    06af25640135771564c18f97294f23b5640991222c20a02004b860694025173c5ac9379e39656d8326da4effb14ef615546fea865ec3745a94f82f64ef311f64

  • SSDEEP

    6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4B:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnR

Score
10/10
osirisbankerbotnet

Malware Config

Targets

    • Target

      5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0

    • Size

      527KB

    • MD5

      5764f48fdd3277b92114e60010f14fde

    • SHA1

      759ca2314be4f0fa951ac4d410f1db79b594dc78

    • SHA256

      5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0

    • SHA512

      06af25640135771564c18f97294f23b5640991222c20a02004b860694025173c5ac9379e39656d8326da4effb14ef615546fea865ec3745a94f82f64ef311f64

    • SSDEEP

      6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4B:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnR

    Score
    10/10
    osirisbankerbotnet

    • Osiris

      bankerbotnetosiris

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Enterprise v15

Tasks