expiro | 1ef0b8da3cb14cf4b04253b532b93bbabb693448595349a17fa99b8135ca3798 | Triage

Sharing

General

Target

1ef0b8da3cb14cf4b04253b532b93bbabb693448595349a17fa99b8135ca3798.exe
Size

600KB
Sample

250102-cat1ssyqcj
MD5

c635b849e21073e20cf3855eecd68fa2
SHA1

2883217c5a519b2151ca328729b34627a605cb50
SHA256

1ef0b8da3cb14cf4b04253b532b93bbabb693448595349a17fa99b8135ca3798
SHA512

8c46289a6ceb65e6ed62e9de91247c4e2778e562496849bbd6e69285d5eb46399da03f28c62dcddb9cd83f48c771c64801f9340a83a0b6e233c93649130840bf
SSDEEP

12288:TEyceS4e+3HggeWaSNQ/1zCFGLMR2WAMMJ1QYrSbPSoTnCFwbatabtkcp100T:TEAa+wgeWZNKRBARhyrSbPS0nCwb+2MO

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  1ef0b8da3cb14cf4b04253b532b93bbabb693448595349a17fa99b8135ca3798.exe
- Size
  
  600KB
- MD5
  
  c635b849e21073e20cf3855eecd68fa2
- SHA1
  
  2883217c5a519b2151ca328729b34627a605cb50
- SHA256
  
  1ef0b8da3cb14cf4b04253b532b93bbabb693448595349a17fa99b8135ca3798
- SHA512
  
  8c46289a6ceb65e6ed62e9de91247c4e2778e562496849bbd6e69285d5eb46399da03f28c62dcddb9cd83f48c771c64801f9340a83a0b6e233c93649130840bf
- SSDEEP
  
  12288:TEyceS4e+3HggeWaSNQ/1zCFGLMR2WAMMJ1QYrSbPSoTnCFwbatabtkcp100T:TEAa+wgeWZNKRBARhyrSbPS0nCwb+2MO
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2

expirobackdoordiscovery