Overview

overview

10

Static

static

3

2aba4a3232...dN.exe

windows7-x64

10

2aba4a3232...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2aba4a323234e0a9ad5a811c175a05ee90cc2deb1c761a92a59f4473d70331ddN.exe

  • Size

    638KB

  • Sample

    241205-l87tzswkcq

  • MD5

    c2479bce000b9225709dfc162ba82e80

  • SHA1

    e008d7ecc0089fb6eef91d4611cd0bdfd4e76049

  • SHA256

    2aba4a323234e0a9ad5a811c175a05ee90cc2deb1c761a92a59f4473d70331dd

  • SHA512

    49c192da068cf0af3ac2c3cde06c819e7e231da2e33c1b4339049f0822256d85f36e220c6203839b1f82e91159bf76b3bf9aac227962582c230a421e0aa493ac

  • SSDEEP

    12288:iRRRaMMMMM2MMMMM/JS2f47CQOcHJW6/5P+B8+8EnAf:iRRRaMMMMM2MMMMM/JS7C5KW05mB8+7Y

Score
10/10
expirobackdoorcredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      2aba4a323234e0a9ad5a811c175a05ee90cc2deb1c761a92a59f4473d70331ddN.exe

    • Size

      638KB

    • MD5

      c2479bce000b9225709dfc162ba82e80

    • SHA1

      e008d7ecc0089fb6eef91d4611cd0bdfd4e76049

    • SHA256

      2aba4a323234e0a9ad5a811c175a05ee90cc2deb1c761a92a59f4473d70331dd

    • SHA512

      49c192da068cf0af3ac2c3cde06c819e7e231da2e33c1b4339049f0822256d85f36e220c6203839b1f82e91159bf76b3bf9aac227962582c230a421e0aa493ac

    • SSDEEP

      12288:iRRRaMMMMM2MMMMM/JS2f47CQOcHJW6/5P+B8+8EnAf:iRRRaMMMMM2MMMMM/JS7C5KW05mB8+7Y

    Score
    10/10
    expirobackdoorcredential_accessdiscoveryspywarestealer

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Drops Chrome extension

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks