expiro | 354a1e28e872ea8b6fadf543a28b673f93f887e96b34350838a5b479276a6509

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16/12/2024, 02:18

Target

354a1e28e872ea8b6fadf543a28b673f93f887e96b34350838a5b479276a6509N.exe
Size

591KB
MD5

e7e16ed37a329694fa26618e64966d70
SHA1

3d92e999ad06c57c8868164c3f07060a63eed18e
SHA256

354a1e28e872ea8b6fadf543a28b673f93f887e96b34350838a5b479276a6509
SHA512

b21b7befe0f2f47f6b15236008c3249f67a14070fddefd35492bdc56d7de357427fa8149d9b238a0f170b7e4e7872d0f0c139a6da1fbfd3b5a9ed637b35ef779
SSDEEP

12288:eGAuvlfWFlwSH6nGgMKNAzzvKD3vPxb28vG+oT5:XlAltH6nGgMU3VQ9

Score

10^/10

expiro backdoor

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/memory/3040-2-0x0000000000400000-0x00000000005B0000-memory.dmp	family_expiro1

C:\Users\Admin\AppData\Local\Temp\354a1e28e872ea8b6fadf543a28b673f93f887e96b34350838a5b479276a6509N.exe
"C:\Users\Admin\AppData\Local\Temp\354a1e28e872ea8b6fadf543a28b673f93f887e96b34350838a5b479276a6509N.exe"
1⤵
PID:3040

memory/3040-0-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/3040-1-0x0000000000405000-0x0000000000406000-memory.dmp

Filesize
4KB

Download
memory/3040-2-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download