General

  • Target

    c8a46327ca3a8a0a5db01c32ba508f20.zip

  • Size

    289KB

  • Sample

    240831-gvqlbszanl

  • MD5

    04876e5dd46a1fd2de022bea57f5d380

  • SHA1

    41970ed31bcc8fc474f0df6b43ade59d2953dad0

  • SHA256

    f65a6c0437aec13cc840e6f957cc81bf7fe91c0d2970c6c079ebb9fffec67a13

  • SHA512

    a8cb8096772336bf4d1a36bea102a4585408909095d11cdb4efb87802665d0150895d0738ced0f1de25b2ea67e6924a340d334d56eb2fe83152a568ffaade579

  • SSDEEP

    6144:yxNYbGxtJj4KQwGTfJvWYCXJkNC0qXV90d7XSRLeVTq2MCnJTz:yPaGyKR6R+YUuNDsV9GALe5zDtz

Malware Config

Targets

    • Target

      a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625

    • Size

      406KB

    • MD5

      c8a46327ca3a8a0a5db01c32ba508f20

    • SHA1

      0e737ae39d373dda72816d12737163ca068a7716

    • SHA256

      a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625

    • SHA512

      468b8b3a828a43e073af6d4c02eb356e608262b1496044e94d0d161eb1976f6d03f6fc23254086e74673a4ffea5ab9054813feb8c5ab0e18e3c5a93cef55e980

    • SSDEEP

      6144:KIzfx0tsmxGjd9suGjWIDhAJSbnVrw8/LppZ2oqIqOEhspJ:1fqOwGTlW9N0Qrw62obqap

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

    • Expiro payload

    • Disables taskbar notifications via registry modification

    • Executes dropped EXE

    • Windows security modification

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks