osiris | 107c83149d4b19b7875d6ec1e0251899662d48dcd13996b9e07a93d378f156b8 | Triage

Sharing

General

Target

107c83149d4b19b7875d6ec1e0251899662d48dcd13996b9e07a93d378f156b8.exe
Size

444KB
Sample

241122-yhmscatkdl
MD5

79a21d060bc9f45a2b5a43a40f672bbc
SHA1

9811d64acf762c59bfeae15548569108f2e9b314
SHA256

107c83149d4b19b7875d6ec1e0251899662d48dcd13996b9e07a93d378f156b8
SHA512

1cda84c6b9b2b23e206731a2b95db1a5cec7d8cb2eb2b6862c84be103603098658d8d0f57e941584177c4958450d8de913bae6a7d315323175f669f0177f6864
SSDEEP

12288:sqiNL0Y/eQ2ZaOpTYP+Xjn+sX9eK+ySCf:sxNL0Y/ezauYP+FX9t+zi

Score

10^/10

osiris banker botnet discovery

Malware Config

Targets

- Target
  
  107c83149d4b19b7875d6ec1e0251899662d48dcd13996b9e07a93d378f156b8.exe
- Size
  
  444KB
- MD5
  
  79a21d060bc9f45a2b5a43a40f672bbc
- SHA1
  
  9811d64acf762c59bfeae15548569108f2e9b314
- SHA256
  
  107c83149d4b19b7875d6ec1e0251899662d48dcd13996b9e07a93d378f156b8
- SHA512
  
  1cda84c6b9b2b23e206731a2b95db1a5cec7d8cb2eb2b6862c84be103603098658d8d0f57e941584177c4958450d8de913bae6a7d315323175f669f0177f6864
- SSDEEP
  
  12288:sqiNL0Y/eQ2ZaOpTYP+Xjn+sX9eK+ySCf:sxNL0Y/ezauYP+FX9t+zi
Score

10^/10

osiris banker botnet discovery
- Osiris
  banker botnet osiris
- Osiris family
  osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnetdiscovery

behavioral2

osirisbankerbotnetdiscovery