osiris | 0817ae08c918d42b35b03fdb36e8b51237a44b27db5599771bd52e952c5ded3a | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...c8.exe

windows7-x64

JaffaCakes...c8.exe

windows10-2004-x64

7

Sharing

General

Target

JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8
Size

527KB
Sample

250109-vaxqssxjcq
MD5

cd2fb5e01efc04746099cfbc0b5b37c8
SHA1

123b81d51d47f3f49eaa8f068e7f79773d799497
SHA256

0817ae08c918d42b35b03fdb36e8b51237a44b27db5599771bd52e952c5ded3a
SHA512

42afcd76db2fd24ed4b8ce1e11b453abf17d4020aad694dbbad49ae53ef1e392a59a0af18bd6afe19757365028bf00026eb8e91b69abe4844d809a8af6617b3e
SSDEEP

6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4x:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnB

Score

10^/10

osiris banker botnet discovery

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8.exe

Resource

win7-20240903-en

osiris banker botnet discovery

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8
- Size
  
  527KB
- MD5
  
  cd2fb5e01efc04746099cfbc0b5b37c8
- SHA1
  
  123b81d51d47f3f49eaa8f068e7f79773d799497
- SHA256
  
  0817ae08c918d42b35b03fdb36e8b51237a44b27db5599771bd52e952c5ded3a
- SHA512
  
  42afcd76db2fd24ed4b8ce1e11b453abf17d4020aad694dbbad49ae53ef1e392a59a0af18bd6afe19757365028bf00026eb8e91b69abe4844d809a8af6617b3e
- SSDEEP
  
  6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4x:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnB
Score

10^/10

osiris banker botnet discovery
- Osiris
  banker botnet osiris
- Osiris family
  osiris
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

osirisbankerbotnetdiscovery

behavioral2

© 2018-2025

Terms | Privacy