Overview

overview

10

Static

static

3

495c8abf54...6e.exe

windows7-x64

10

495c8abf54...6e.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe

  • Size

    527KB

  • Sample

    241123-e686psykfv

  • MD5

    6b5d0cd96161a9234da0222c6de4a1cc

  • SHA1

    d5707598973611a4d797a69efd5b977f0360b04b

  • SHA256

    495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e

  • SHA512

    d9665205dc1be22676e0de33b378e83aaddb8f77256d4ee91f35569b2d51c77d9c6d26ea2b5352119103fa4c82c34c283326dd8b53833de1985f17241db0f1cf

  • SSDEEP

    6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4z:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnD

Score
10/10
osirisbankerbotnetdiscovery

Malware Config

Targets

    • Target

      495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e.exe

    • Size

      527KB

    • MD5

      6b5d0cd96161a9234da0222c6de4a1cc

    • SHA1

      d5707598973611a4d797a69efd5b977f0360b04b

    • SHA256

      495c8abf54ea82c59e1ac41a9b486b3d8ea72ebb58cd370c0aba4c753b1cdd6e

    • SHA512

      d9665205dc1be22676e0de33b378e83aaddb8f77256d4ee91f35569b2d51c77d9c6d26ea2b5352119103fa4c82c34c283326dd8b53833de1985f17241db0f1cf

    • SSDEEP

      6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4z:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnD

    Score
    10/10
    osirisbankerbotnetdiscovery

    • Osiris

      bankerbotnetosiris

    • Osiris family

      osiris

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks