expiro | 699bd6894d3fe09c40dac274499a1bc6c1f57b6c92e31dc5f9f6e63c04c8e2b2 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...81.exe

windows7-x64

JaffaCakes...81.exe

windows10-2004-x64

1

Sharing

General

Target

JaffaCakes118_574ae82593de221115bfcabdf4ff4f81
Size

661KB
Sample

250101-qy9ytayrep
MD5

574ae82593de221115bfcabdf4ff4f81
SHA1

aec60c1bd67ce9278de10e6db9ff11e2a109a5b8
SHA256

699bd6894d3fe09c40dac274499a1bc6c1f57b6c92e31dc5f9f6e63c04c8e2b2
SHA512

790c4798345cd75b84594a84203c192f8ee29790df146ab0871e5668ee231c70e1d5bc2a3f31ceb9d8a9882340b20b19963c93c937ec20693ecb904712922b98
SSDEEP

12288:vUNIB5h08gJmKC9TovAW7E+Q1uHwQgMEzMK+tplNZyeft0+bdXOV5fk:qInh5g56TJ4vQ1uQQiMK+tplNZvi+b9e

Score

10^/10

expiro backdoor discovery evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_574ae82593de221115bfcabdf4ff4f81.exe

Resource

win7-20240903-en

expiro backdoor discovery evasion trojan

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_574ae82593de221115bfcabdf4ff4f81.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_574ae82593de221115bfcabdf4ff4f81
- Size
  
  661KB
- MD5
  
  574ae82593de221115bfcabdf4ff4f81
- SHA1
  
  aec60c1bd67ce9278de10e6db9ff11e2a109a5b8
- SHA256
  
  699bd6894d3fe09c40dac274499a1bc6c1f57b6c92e31dc5f9f6e63c04c8e2b2
- SHA512
  
  790c4798345cd75b84594a84203c192f8ee29790df146ab0871e5668ee231c70e1d5bc2a3f31ceb9d8a9882340b20b19963c93c937ec20693ecb904712922b98
- SSDEEP
  
  12288:vUNIB5h08gJmKC9TovAW7E+Q1uHwQgMEzMK+tplNZyeft0+bdXOV5fk:qInh5g56TJ4vQ1uQQiMK+tplNZvi+b9e
Score

10^/10

expiro backdoor discovery evasion trojan
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscoveryevasiontrojan

behavioral2

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.