expiro | 2bfb32b4699fcd7b8061f70f517cb08abf5a0c01ce515e5d8b437bac14385834 | Triage

Sharing

General

Target

JaffaCakes118_69b39da7efbfa6c986e6e215d35b7290
Size

501KB
Sample

250103-c24djsynhl
MD5

69b39da7efbfa6c986e6e215d35b7290
SHA1

916991c2ce6f7cc2e4873de608687c7bff634c10
SHA256

2bfb32b4699fcd7b8061f70f517cb08abf5a0c01ce515e5d8b437bac14385834
SHA512

b89daa15f07f2b15b602f05a25b98f994141d371a8ef1b1ab656216726bc42a67dc1cb0d2d617a0dfbf478232682583d6743e056147ab17befacd69be7e2116a
SSDEEP

6144:NhK9K67liNZr67uosOUlo40qeyZIn8gEmvCwmRFOUM6rWjQ9FbqUvRZv8v6jyOqB:DMT7um1YYtUK6rWQhvRZEv6jfIqg+Yy

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_69b39da7efbfa6c986e6e215d35b7290
- Size
  
  501KB
- MD5
  
  69b39da7efbfa6c986e6e215d35b7290
- SHA1
  
  916991c2ce6f7cc2e4873de608687c7bff634c10
- SHA256
  
  2bfb32b4699fcd7b8061f70f517cb08abf5a0c01ce515e5d8b437bac14385834
- SHA512
  
  b89daa15f07f2b15b602f05a25b98f994141d371a8ef1b1ab656216726bc42a67dc1cb0d2d617a0dfbf478232682583d6743e056147ab17befacd69be7e2116a
- SSDEEP
  
  6144:NhK9K67liNZr67uosOUlo40qeyZIn8gEmvCwmRFOUM6rWjQ9FbqUvRZv8v6jyOqB:DMT7um1YYtUK6rWQhvRZEv6jfIqg+Yy
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2