expiro | 934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923 | Triage

Sharing

General

Target

934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923.exe
Size

623KB
Sample

241205-bd13vawlfq
MD5

569476655dbe26c2425b7b52632a002c
SHA1

c1e7ccbfc7dd7d820ea17e20af63499a460faa9a
SHA256

934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923
SHA512

09d9b865bf03f0be25b80f0e3bec0332ee1249c8b3c50190462d830a565ca9a9556e54a98d5c2308f35069408a739f98a12b62abcb1a36c336ae68a6a49b1559
SSDEEP

12288:RXhOqySkMyvKNprvA2ymfK5ZlSMDyS1CAz1fXhUZ2Ls3d+jZjIvQJwCMtXjDnSBf:RX8qyFMWuprXOSMDJwcA39C

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923.exe
- Size
  
  623KB
- MD5
  
  569476655dbe26c2425b7b52632a002c
- SHA1
  
  c1e7ccbfc7dd7d820ea17e20af63499a460faa9a
- SHA256
  
  934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923
- SHA512
  
  09d9b865bf03f0be25b80f0e3bec0332ee1249c8b3c50190462d830a565ca9a9556e54a98d5c2308f35069408a739f98a12b62abcb1a36c336ae68a6a49b1559
- SSDEEP
  
  12288:RXhOqySkMyvKNprvA2ymfK5ZlSMDyS1CAz1fXhUZ2Ls3d+jZjIvQJwCMtXjDnSBf:RX8qyFMWuprXOSMDJwcA39C
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2