osiris | 50ed9de5ba4828584dcc478620835fae40345a277ca62ebf6387e4a3f6942097 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

16c71b556f...18.exe

windows7-x64

16c71b556f...18.exe

windows10-2004-x64

7

Sharing

General

Target

16c71b556f6acea038c2c043c99909a2_JaffaCakes118
Size

434KB
Sample

240627-vhjh5s1bla
MD5

16c71b556f6acea038c2c043c99909a2
SHA1

0d366eae661cd5fcf83880bb3e7523134d965f95
SHA256

50ed9de5ba4828584dcc478620835fae40345a277ca62ebf6387e4a3f6942097
SHA512

3b8937c907667bbd736d73acc66d39207b870c702a2599667c586ab10a179c3fa6266351c493778f98522f10678af45e0598da434394b8399cbbe1e7792a3b53
SSDEEP

12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK95OTTsx/SA/WegYfdNbrqnuW:rXh6XcBXo8TsL8Y8m4OTTySA/DrfdNbs

Score

10^/10

osiris banker botnet

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

16c71b556f6acea038c2c043c99909a2_JaffaCakes118.exe

Resource

win7-20240611-en

osiris banker botnet

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

16c71b556f6acea038c2c043c99909a2_JaffaCakes118.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  16c71b556f6acea038c2c043c99909a2_JaffaCakes118
- Size
  
  434KB
- MD5
  
  16c71b556f6acea038c2c043c99909a2
- SHA1
  
  0d366eae661cd5fcf83880bb3e7523134d965f95
- SHA256
  
  50ed9de5ba4828584dcc478620835fae40345a277ca62ebf6387e4a3f6942097
- SHA512
  
  3b8937c907667bbd736d73acc66d39207b870c702a2599667c586ab10a179c3fa6266351c493778f98522f10678af45e0598da434394b8399cbbe1e7792a3b53
- SSDEEP
  
  12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK95OTTsx/SA/WegYfdNbrqnuW:rXh6XcBXo8TsL8Y8m4OTTySA/DrfdNbs
Score

10^/10

osiris banker botnet
- Osiris
  banker botnet osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnet

behavioral2

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.