expiro | e40cf5f563bf3d1cb496efada0fd24d02dafef11fd4c883409119f112b4844b0 | Triage

Sharing

General

Target

JaffaCakes118_6771bf9eb822a0f324cd6bc073392260
Size

701KB
Sample

250102-xnla2avkhq
MD5

6771bf9eb822a0f324cd6bc073392260
SHA1

cd2b3895225e7d9cb90d4bcf36fea34552317042
SHA256

e40cf5f563bf3d1cb496efada0fd24d02dafef11fd4c883409119f112b4844b0
SHA512

0e9be825ed3776b98f693af76c5e4cc9f9fc219b80f92ed69b372195a16937f9f9ac3c2d1dce2846d1059019e24cdaa31752aaecda7978306e6b25ba4bf13ae0
SSDEEP

12288:ONWDKVAQRyJ25TK63lkpBxGSoSiaHzKvqWlllmyKCvZoLFp80MeU:ONWEIJ25TKnBx1FTJWllkyHvZoBp8Xe

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_6771bf9eb822a0f324cd6bc073392260
- Size
  
  701KB
- MD5
  
  6771bf9eb822a0f324cd6bc073392260
- SHA1
  
  cd2b3895225e7d9cb90d4bcf36fea34552317042
- SHA256
  
  e40cf5f563bf3d1cb496efada0fd24d02dafef11fd4c883409119f112b4844b0
- SHA512
  
  0e9be825ed3776b98f693af76c5e4cc9f9fc219b80f92ed69b372195a16937f9f9ac3c2d1dce2846d1059019e24cdaa31752aaecda7978306e6b25ba4bf13ae0
- SSDEEP
  
  12288:ONWDKVAQRyJ25TK63lkpBxGSoSiaHzKvqWlllmyKCvZoLFp80MeU:ONWEIJ25TKnBx1FTJWllkyHvZoBp8Xe
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

expirobackdoordiscovery