---
title: Long Live, Osiris; Banking Trojan Targets German IP Addresses
description: Morphisec Labs outlines an Osiris banking trojan campaign used against IP addresses in Germany. This blog reveals every stage of the attack chain.
image: https://www.morphisec.com/hubfs/Osiris%20Banking%20Trojan%20Targets%20German%20IP%20Addresses.png
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Long Live, Osiris; Banking Trojan Targets German IP Addresses

Posted by [Michael Dereviashkin](https://1534169.hs-sites.com/author/michael-dereviashkin) on February 8, 2021

- [Tweet](https://twitter.com/share)

## ![Osiris Trojan Targets German IP Addresses](https://www.morphisec.com/hubfs/Osiris%20Banking%20Trojan%20Targets%20German%20IP%20Addresses.png)

Between January 15 and 20, Morphisec identified a significant campaign targeting multiple German customers in manufacturing. Targeted personnel were redirected to compromised websites that were, and still are, delivering advanced fileless downloaders that eventually lead to an Osiris client with a bundled mini-Tor communicating to a C2 onion Tor panel.

After an additional investigation we shared some of the TTPs with the security community. We were then notified of additional targeted countries, including the United States and Korea, which were delivered REvil and other payloads using the same delivery mechanism as described in the report. 

In this blog, we go over every stage of the attack chain in the German campaign.

## Technical Introduction

The attack chain is composed of five main stages;

- An obfuscated Javascript downloader from a compromised site 
- A Second stage Javascript downloader that takes care of persistence
- A Powershell executed by the Javascript that leads to reflective loading of the next stage .NET file
- A fileless .NET loader that’s mapped from the registry and decodes to a new .NET hollower in-memory executable, which is responsible for hollowing the **Osiris trojan** into a legitimate Windows process.
- Osiris connects to its C2 with the help of a mini-Tor bundle.

## ![Osiris Banking Trojan Attack Chain](https://www.morphisec.com/hubfs/Osiris%20Infographic.png)

**Figure 1: The Osiris attack chain.**

## Initial Access

The victim receives a link to a compromised website that contains a download link to a malicious zip file, which then contains a JS file. , the web page and the file name translates to *“collective agreement on-call remuneration ig metal.”*

The download as well as the rest of the attack chain communication will be available only to an IP located in Germany.

![A screenshot taken from a compromised website](https://lh5.googleusercontent.com/rLUa_ok5wkJyD3uXLZ-C5s0y-Wg62i-zEnfbzEfeyI56nnz7F-Lm8zcE5vFZ1oBr01sxflyyrkUT9BTGNV0O09T53VIu9Z6xNTy7nZ_IpLWIMYWDho3dzB9dpngLlA4u78pnfT-L)

Figure** 2: The compromised website.**

The screen shot above is taken from the compromised website.

### Stage 1 - Javascript downloader

The JavaScript file inside the zip archive:

![An image of the Javascript file the Osiris banking trojan uses inside the ZIP archive](https://lh4.googleusercontent.com/y6nSuZv18gLUA_u-vUmtnh0ABohR5c-ZH-uqDJ-ZJJuxjtNqwyCmBAyh1RtANcM7IpWHBrBn-iDVHqYW8SXvVAcFw_rGYlb2MmOqEn1OqiaQaQsSE_D-yVst527HSIZ2GXLVJ4b8)

**Figure 3: The JavaScript file.**

The screenshot below is a formatted view of the malicious Javascript:

![The malicious Javascript downloader formatted to be readable](https://lh4.googleusercontent.com/lmbyWpDe3sTbv8iSCMEURqrtVqF1x0M5PKSnbuQo8PSySx7xq88RkDrdyH8czUqtMIlQJCwj44SHHpRak-LPzsdTyN3drIO3Wlch6lQ1YA_Tjt2IxOr3vJfjV8yjsLuYSMqaNeU2)

**Figure 4: A formatted view of the malicious JavaScript**

As seen above, the Javascript  code is composed of dictionary generated code and includes real words in order to evade the static file scan used by AV solutions for obfuscation detection.  It’s important to note that for every new download of javascript, the JS code won’t be exactly the same, but it will have a similar structure.

In order to deobfuscate the embedded code in all Javascript stages, the following code snippet can be used:

![This code snippet can be used to deobfuscate the embedded code](https://lh4.googleusercontent.com/cHoyePDFnYbe8O4-uQbMJ6tk6ZTOXyhORt48ZEzC1s42P_KCq2zrg9_SDtIJeLgs-iNBckPbXfgzNv7gwWRqyt3NqIPXvXme6SM2r60HCHH5qT_f3HElvEAVpfEluThDPNvPt6r7)

**Figure 5: Deobfuscating the JavaScript**

#### Step 2

The “*prove” *variable (the long obfuscated string) actually contains the embedded next step obfuscated Javascript code that deobfuscates itself into:

![The next-step Javascript deobfuscates itself into this code](https://lh6.googleusercontent.com/KBXO5v5z7R1a2_V04RIWX10A1YwRF3h2cKadUsCrOMP_69ApK14dSbjXg1HNGxf0fILXPbyF2zSud-Ko5aGSIj9rfaw6mek0VCac6oAbk8PWa6mLZ6JmN9QAWdtSa9dWLNvZGpV-)

**Figure 6: The "prove" variable.**

Note that for every new download of Javascript, the unique id is represented by the registry path generated within the “*HKCU/<Random 5 letters>.”  *The “*create”  *function is then called with the Javascript code execution in the next step.

#### Step 3

As seen on the screenshot below, the Javascript contains three domains that the code attempts to communicate with. It’s worth mentioning that they are also compromised (those domains change every couple of days).

![The three domains contained within the Javascript](https://lh4.googleusercontent.com/axuHCnlYKz9JKmDLad9Kfc9eMw43mxFCQrfHY69ss1UxXRHns_9OJsmNeash_skvEwRHfELZZX-vSUn3hhX4Sja_ow9D2i72UqJrRbG9FdRxaCbtL--rCtRwO6yuKtxVHYuwSpAw)

**Figure 7: The three compromised domains **the** code communicates with.**

The parameter for ‘search’ is also unique per download. The script identifies if the machine is located in a domain by expending the environment variable *%USERDNSDOMAIN%*. Depending on what it receives, it sends a different get request to the compromised website with a high possibility for a different malware.

### Stage 2 - Javascript persistence 

The second stage formatted Javascript is delivered only to German IP addresses. The code already includes its next stage .NET code, which will be persisted into registry.

![The second-stage code that's only delivered to IP addresses in Germany](https://lh5.googleusercontent.com/HHTFgAFlH51qHY2CqCzDsdQgxHoZE7Dt64cGCNtLmVtUGBiPpRsmoZyBFTMtzYfvItOpzLZTHbN5pk-2igVRVvtJ4Os7no6rhZ3iLevn4t9iQe__ZycGtepx8cDA_6_lKvzwaA-a)

**Figure 8: The second stage formatted JavaScript.**

![32-bit Powershell executed using CMD.](https://lh4.googleusercontent.com/ZjAWPlcnw8MqHWP4Cx4YZLuQRXXzVyMsotuCOemc3BevwnKzqsFiRJI5wFktCL3aKRmwWjoTIpbz9bEvKoZfudWm3dELL2GUiUAn3LJtoQ6zDesMYk6LdEzQDONyNIzNsevEkqVH)

**Figure 9: The JavaScript executing 32-bit Powershell**

As seen above, the Javascript code will execute 32-bit Powershell using cmd. It identifies the OS architecture by validating the program files directory name extension. 

### Powershell - reflective loading

The executed Powershell command reflectively loads the next stage .NET executable from registry represented by “*HKCU:\SOFTWARE\<username>1”, *but not before applying a minimalistic deobfuscation replacement algorithm on the value of the registry :

![The minimalistic deobfuscation replacement algorithm on the value of the registry](https://lh4.googleusercontent.com/FN_tMoxBx27ylvS-Cf1Qi6ud77bDk33PJIrEhCgSFSrnCMOqYi-0iX6F1XwYCXeYL4fJNjvdp_zpC_pnCfsnEI3XPogHV1lSUUDRVz1TIm8IDOCNT-xKfnzVoSvLPcavZBFvrSNG)

**Figure 10: Reflective loading of the next stage.**

A simple search in VirusTotal that is based on the replacement function *“chba”* will lead to previous versions of the Powershell that are dependent on “*HKCU:\SOFTWARE\<****machine name****>1.”*

### .NET loader

As seen from the previous stages, the .NET loader is a small size code that is written to the registry by the second stage Javascript and is loaded to the memory by the third stage Powershell reflective loader

![The .NET loader](https://lh6.googleusercontent.com/w17kgc09oKMonusw-Z-BB6cNo_iJbU5LxX4ZSLhbs8J9-fUAwj6aX1lUXcVAcoUzaALwZ7J48AUIGGOLOAmrs9x-JDHFlTc7_-Qg3sGzOetl0XDq2EGjiul693ctTLXm6Q_FtZJu)

Figure** 11: The .NET loader**

The .NET loader will add additional persistence and is responsible for decoding the next step .NET hollower variant, which is located under “*HKCU:\SOFTWARE\<machine name>” *(without the 1).

![Additional persistence added by the .NET loader](https://lh6.googleusercontent.com/kGhv1PtsnCLMePWqhVbg_WgoIFB932wRKVxRcp7P8bdJ3H5jbPgpJTSko8osx9eTztYa3hezai_DL2p251ka6X0q1_5vroaZouWyOB_BX5aydkCNsuf3yPEiii8N2sIHUqCq9_Hv)

**Figure 12: The .NET hollower variant.**

The .NET code under <username> is obviously much larger than the loader as it includes both the hollowing functionality and the *Osiris code*.

![The .NET code that includes both hollowing and Osiris](https://lh6.googleusercontent.com/Z-l-SpeRgAJCA9ts-abopCSnmgQX4zPxoUNDGmyT1UUohOMEgPgC-Mr0FgZgY0TxD_VdfIFJpRsZd0nH4gBNUltUO8oIBfNxjP7ryHbK1fUuZ1_RnRVyRk27V0EJ2IRFNggHj821)

**Figure 13: The .NET code containing hollowing and Osiris.**

This .NET hollower injects the Osiris executable into a legitimate “*ImagingDevice*” executable that comes preinstalled with Windows as part of the Windows Photo Viewer software.

![The .NET hollower injecting Osiris](https://lh3.googleusercontent.com/74Fo0ClylsvgrH2rzOytPjvD_huJhI4yV8SKzVAfzooGe9CY-v2WU6vL8dOCitpqPNRkhkuamZI1m2kRjLL18J7GLmVJzn37mQ4eCEGpPfVgr5OzYGMKwBFi3Np6oNRyBe84wucV)

**Figure 14: The .NET hollower injecting Osiris.**

## Osiris TROJAN

Following the hollowing, the Osiris executable uses its bundled mini-Tor component to communicate with a Tor panel. As can be seen below, the banking trojan still implements many of its original banker functionalities.

![Osiris communicates with its Tor panel](https://lh6.googleusercontent.com/a5E0TsoOVDA_-D2LrrYIQbJ46XKpKww5nHYM7rYFIw669mkooZ-RIGAJYNYiGcxGXK1LLlc3qPrPy3saBkeGSHoQugEdYoKgzTmDkEfVJIrUua8jbgPiXnupaF9QisY6-SPZ-q6B)

**Figure 15: The Osiris executable uses a bundled mini-Tor.**

![Osiris executable](https://lh3.googleusercontent.com/k9BHpxjfGuAgxJ4C6B1tXARBhGBMMJAmXYxU4t7ICjcblsuRXB0_BJyaNm5HQd3eNq_Lu5rIWyZ2A3zp7lzfRCR-s7zvTDASyh-AicaF-uMrLrhOquxqrA8egsNwMgIfGHRBhofK)

**Figure 16: Osiris retains some banker functionality.**

![Some of the original banker functionalities](https://lh3.googleusercontent.com/N9KxDa6ryZ2S_gkg5tNruXqr1EOSa_PzyIOZhxAoz3IoFCkf5fORHCCjhZ2rWzJTjE-2jasxUXYaX5Ne7Hu9YCpERrK1JNtzwKpH_XBaB0trBMqb0sQ9sRMPkzI0ScM0CeFlG2gd)

**Figure 17: Some banker **functionality** in Osiris.**

Artifact file - bundled mini-Tor.

![The bundled mini-Tor](https://lh4.googleusercontent.com/QE9Cy5KxzRQ9f0UumFYLqcFJlzSVTwMRSJFHTQ8bxqmQ-0E1yPcIvJDnoSMbOCYtFrzJLMTFaIZGhP498tf9LE_YIKUJmxM0xMCCG_bHmU1gTfASYjUcYNhoqVxYEmppGEqYAXtu)

**Figure 18: A bundled mini-Tor.**

## Conclusion

The *Osiris trojan* attacking German IP addresses continues the trojan’s historical use. The Morphisec platform blocks Osiris with a zero-trust default-deny approach to endpoint security, powered by moving target defense. Customers of Morphisec are thus protected from Osiris, regardless of what defense evasion techniques the authors deploy.  

### IOC:

EC936B6BB7497FFB11577C14A9AB2860EC1DD705DC18225BBDAB5BF57804BDBC -  JS

72C5EEB8807A4576340485377CACC582A3CA651C4632DB06903C125BE6692968 - .NET module <username1>

63C62D6086A6CF2FCBB22A16C06EB0BC870CDB2F0BB029390D3BC815C06A6C6B - .NET module <username>

2FC970B717486762F6C890F525329962662074EB632F0827C901FB1081CBD98F - Osiris

91F1023142B7BABF6FF75DAD984C2A35BDE61DC9E61F45483F4B65008576D581 - Minitor www.underregnbuen[.]dk/?p=5739 - the compromised website

hxxp://ylnfkeznzg7o4xjf[.]onion/kpanel/connect.php - Osiris C2

[![the-growing-ransomware-threat-and-what-you-can-do-to-fight-back](https://no-cache.hubspot.com/cta/default/1534169/d9fd9894-e27f-4cbe-b476-8c321c26f3d0.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d9fd9894-e27f-4cbe-b476-8c321c26f3d0)

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/long-live-osiris-banking-trojan-targets-german-ip-addresses#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Michael Dereviashkin",
    "url" : "https://1534169.hs-sites.com/author/michael-dereviashkin"
  },
  "dateModified" : "2022-10-26T18:58:17.810Z",
  "datePublished" : "2021-02-08T15:45:00.000Z",
  "headline" : "Long Live, Osiris; Banking Trojan Targets German IP Addresses",
  "image" : [ "https://www.morphisec.com/hubfs/Osiris%20Banking%20Trojan%20Targets%20German%20IP%20Addresses.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/long-live-osiris-banking-trojan-targets-german-ip-addresses",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```