expiro | 67eb7fd773412f45592e93da44f06960c92a245aae356349dee9171f5ed8bae6 | Triage

Sharing

General

Target

JaffaCakes118_679336e9681bce4babde58d1822cf584
Size

875KB
Sample

250102-xyz7yaskev
MD5

679336e9681bce4babde58d1822cf584
SHA1

37018add47ff572ba48adac742fb8dc7272c4832
SHA256

67eb7fd773412f45592e93da44f06960c92a245aae356349dee9171f5ed8bae6
SHA512

160e727989f9c59586961b3c97b2fa90a497efc5c3ce9f7e67365a5f44d3c9fa4986eb589599bb73fba8403242a527aa8d6ee3e93c59296731de67f82ecac4c5
SSDEEP

24576:pQtN/7DSBfWhzn6OZTxJ2L+AH7W7lvgX:pKh7GBfWBn6OZTkH7Qo

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_679336e9681bce4babde58d1822cf584
- Size
  
  875KB
- MD5
  
  679336e9681bce4babde58d1822cf584
- SHA1
  
  37018add47ff572ba48adac742fb8dc7272c4832
- SHA256
  
  67eb7fd773412f45592e93da44f06960c92a245aae356349dee9171f5ed8bae6
- SHA512
  
  160e727989f9c59586961b3c97b2fa90a497efc5c3ce9f7e67365a5f44d3c9fa4986eb589599bb73fba8403242a527aa8d6ee3e93c59296731de67f82ecac4c5
- SSDEEP
  
  24576:pQtN/7DSBfWhzn6OZTxJ2L+AH7W7lvgX:pKh7GBfWBn6OZTkH7Qo
Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoorcredential_accessdiscoveryevasionspywarestealertrojan

behavioral2

expirobackdoorcredential_accessdiscoveryspywarestealer