Analysis
-
max time kernel
94s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/01/2025, 12:38
General
-
Target
JaffaCakes118_65275918852986782eba3a17422da213.exe
-
Size
635KB
-
MD5
65275918852986782eba3a17422da213
-
SHA1
976edab0177ae84c34c3ccebab862eba63faa02d
-
SHA256
bf121d562c7c7b94ad46b0f48668659e2f41fa6a0a5f482fdf22f3a6a2195836
-
SHA512
1d3b8dde856409c7e5ef02322e27a4a676c2010651cd72758cb5578a0fe4a6cdbbfdf47331a3b22ad1158381e8c48964112d7d63789d748b662ce055e725edf5
-
SSDEEP
12288:RaIH1DGXNWHcbQueOqk2FIaHgv1HqdWZm6jORchUmaEvlUpSZA15WS77:9mNmpWHhW5EvlSSq1
Score
10/10
Malware Config
Signatures
-
Expiro family
-
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
-
Expiro payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65275918852986782eba3a17422da213.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65275918852986782eba3a17422da213.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB