General

  • Target

    bb14c689eca3f4ea842264420ff4f64f644d6217816bfc2698bf5213bba7325d

  • Size

    405KB

  • Sample

    240830-3ebm5asgjk

  • MD5

    751288b2127eb807bee5f9c684780ea5

  • SHA1

    3f250ff4509f450b685a87570cb86f3083e61a33

  • SHA256

    bb14c689eca3f4ea842264420ff4f64f644d6217816bfc2698bf5213bba7325d

  • SHA512

    016c5d8ce72a102f1acc8b58c5b9a2d50c06ed4241bb5404e3b7c74d323e44e78e889b20d4fc4f09785a49227dc99a9266ad3412c90dde9e4900b69377e806bc

  • SSDEEP

    12288:9Y9IsaC3285d9SdAF8+l0iX0DjXqqGFFxbEURq6I6w+UXH:9Y6s7DMYOy0TGBWjH

Malware Config

Targets

    • Target

      f5b382bc456b1d14a712467ace85ffb2ce80ad98523170ea976775b69914bcbd

    • Size

      625KB

    • MD5

      1db33c93b3dc0aefdf98d72881bbc259

    • SHA1

      85b28dbed026216c851e89ac18f48d1e2caf897a

    • SHA256

      f5b382bc456b1d14a712467ace85ffb2ce80ad98523170ea976775b69914bcbd

    • SHA512

      056393197ac05950ac6a245bfe9acfc5b688a83956637221d116bab181b96c4a1959931b83d5f27da67e0a4649df17380a46c10074fca73a46a276e7bf092cd3

    • SSDEEP

      12288:RVt+w8wyv//66WoJMH4xBLc8A5N2mYgxRFTLxT4NH:Ht+w5yvDJs8JrMHxT

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

    • Expiro payload

    • Disables taskbar notifications via registry modification

    • Executes dropped EXE

    • Windows security modification

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks