Overview

overview

10

Static

static

3

7dd32adae1...b7.exe

windows7-x64

10

7dd32adae1...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7dd32adae1b33b5d3f041e723f648d883bee7485b8e48f1aec3c4ffabac00eb7

  • Size

    567KB

  • Sample

    241220-cmzf2sxkgr

  • MD5

    0ea4caaae0f84e80b1d20c2de766f046

  • SHA1

    3bba16483ce758075ffe5ede4e81699a952d552a

  • SHA256

    7dd32adae1b33b5d3f041e723f648d883bee7485b8e48f1aec3c4ffabac00eb7

  • SHA512

    02d8194be60c58546de9b363371cd7d9bc14b0ebccfbf483c72afc1fce2cc35bbdc71807d5323cde03ed2b62349dc33d3792d2c078d77f3434a6ab4c05d77914

  • SSDEEP

    12288:agwzKlEa58XMiOs2XK6zF924eDUeFy/NROXAqpR8djy:ZGe8XMLsS5R92JDUeE/NROQq0y

Score
10/10
expirobackdoordiscovery

Malware Config

Targets

    • Target

      7dd32adae1b33b5d3f041e723f648d883bee7485b8e48f1aec3c4ffabac00eb7

    • Size

      567KB

    • MD5

      0ea4caaae0f84e80b1d20c2de766f046

    • SHA1

      3bba16483ce758075ffe5ede4e81699a952d552a

    • SHA256

      7dd32adae1b33b5d3f041e723f648d883bee7485b8e48f1aec3c4ffabac00eb7

    • SHA512

      02d8194be60c58546de9b363371cd7d9bc14b0ebccfbf483c72afc1fce2cc35bbdc71807d5323cde03ed2b62349dc33d3792d2c078d77f3434a6ab4c05d77914

    • SSDEEP

      12288:agwzKlEa58XMiOs2XK6zF924eDUeFy/NROXAqpR8djy:ZGe8XMLsS5R92JDUeE/NROQq0y

    Score
    10/10
    expirobackdoordiscovery

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks