expiro | 03643ee86f4eb18591679eb55403feac2c56b3df552ae3810a18176f58c85a1f | Triage

Sharing

General

Target

03643ee86f4eb18591679eb55403feac2c56b3df552ae3810a18176f58c85a1f
Size

1.1MB
Sample

241220-x2k77aspdn
MD5

eba18bf1eb35d4aa920f1523f415cbf8
SHA1

3c0645d49eb1b579e9e6cae64537f9130360ec94
SHA256

03643ee86f4eb18591679eb55403feac2c56b3df552ae3810a18176f58c85a1f
SHA512

24b7649978d8bb8dced2055c12e873b842e48d5c0e0e651524db93fbaaf8978a152558651da16b81f8a321510de02a54c80f52e4aeec4d3c461fc1ba81daef4d
SSDEEP

12288:cKIdUmr4yORf11rgnTSLSgQDVs2ExLj1DFDAD4pCoWb98vL8ns2ExLj1DFDAD4p:BI4lL+TSXQDfetWbQgetWbQ

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  03643ee86f4eb18591679eb55403feac2c56b3df552ae3810a18176f58c85a1f
- Size
  
  1.1MB
- MD5
  
  eba18bf1eb35d4aa920f1523f415cbf8
- SHA1
  
  3c0645d49eb1b579e9e6cae64537f9130360ec94
- SHA256
  
  03643ee86f4eb18591679eb55403feac2c56b3df552ae3810a18176f58c85a1f
- SHA512
  
  24b7649978d8bb8dced2055c12e873b842e48d5c0e0e651524db93fbaaf8978a152558651da16b81f8a321510de02a54c80f52e4aeec4d3c461fc1ba81daef4d
- SSDEEP
  
  12288:cKIdUmr4yORf11rgnTSLSgQDVs2ExLj1DFDAD4pCoWb98vL8ns2ExLj1DFDAD4p:BI4lL+TSXQDfetWbQgetWbQ
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2