← Back to malware index
Osiris banker (Kronos variant)
Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.
3 syscalls cited
- NtCreateTransaction
Creates a new KTM (Kernel Transaction Manager) transaction object used to wrap NTFS operations atomically.
- NtCommitTransaction
Commits a KTM transaction, atomically persisting every change made under it to disk.
- NtRollbackTransaction
Rolls back a KTM transaction, discarding every change made under it.