Overview

overview

10

Static

static

3

9c73603313...18.exe

windows7-x64

3

9c73603313...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9c73603313f6aadc2d0819d0512323b9_JaffaCakes118

  • Size

    561KB

  • Sample

    240816-b1hj1ssdkq

  • MD5

    9c73603313f6aadc2d0819d0512323b9

  • SHA1

    9f245045d0ed54ad70e2e68042303e0b96aec6c6

  • SHA256

    6c5dac9043b2f112543f3eca6503d4bcc70d762b47d75dcb85f9767c603de56f

  • SHA512

    9431e42f14b60d4eb69bb47b75a96b657251752f6faedf616659257ad4cc3f9b07a305b51a2a56455d18e36d2b87317a357eed739e02c09d0470e55923e8240c

  • SSDEEP

    12288:kW7+Efb8ddrxs7Y/wwBQTtGk5pIrD9q0RVwVSakQZ1DEmam12ZvaY4VXaFZ:kW7+Efb8ddrxs7Y/wwBQTtLOD9fRVw8n

Score
10/10
osirisbankerbotnetdiscoverypersistence

Malware Config

Targets

    • Target

      9c73603313f6aadc2d0819d0512323b9_JaffaCakes118

    • Size

      561KB

    • MD5

      9c73603313f6aadc2d0819d0512323b9

    • SHA1

      9f245045d0ed54ad70e2e68042303e0b96aec6c6

    • SHA256

      6c5dac9043b2f112543f3eca6503d4bcc70d762b47d75dcb85f9767c603de56f

    • SHA512

      9431e42f14b60d4eb69bb47b75a96b657251752f6faedf616659257ad4cc3f9b07a305b51a2a56455d18e36d2b87317a357eed739e02c09d0470e55923e8240c

    • SSDEEP

      12288:kW7+Efb8ddrxs7Y/wwBQTtGk5pIrD9q0RVwVSakQZ1DEmam12ZvaY4VXaFZ:kW7+Efb8ddrxs7Y/wwBQTtLOD9fRVw8n

    Score
    10/10
    discoveryosirisbankerbotnetpersistence

    • Osiris

      bankerbotnetosiris

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks