expiro | 0666bbd94c6ddacffdbb4eae6951923c12a84e9b5a081734c24aea93b2bfbca1 | Triage

Sharing

General

Target

JaffaCakes118_6f0d2894860ffa6438d9d8967f179340
Size

516KB
Sample

250103-ybpncszlft
MD5

6f0d2894860ffa6438d9d8967f179340
SHA1

837fcf9778cf5e19d03e49ba3c043c1ae03614ab
SHA256

0666bbd94c6ddacffdbb4eae6951923c12a84e9b5a081734c24aea93b2bfbca1
SHA512

b2ced8dde582e049860a757ad0b7b09cf7548cc5f82e4233503c1ec460801c341c11b9b086709f503721b2479f699e5e545cd779e876946e48be10914f3a2ce9
SSDEEP

12288:wGZZW23TOmc1ZJ76vlHhM1N8bd+qUbtcY:17W23SbnJ0H6ebdapcY

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_6f0d2894860ffa6438d9d8967f179340
- Size
  
  516KB
- MD5
  
  6f0d2894860ffa6438d9d8967f179340
- SHA1
  
  837fcf9778cf5e19d03e49ba3c043c1ae03614ab
- SHA256
  
  0666bbd94c6ddacffdbb4eae6951923c12a84e9b5a081734c24aea93b2bfbca1
- SHA512
  
  b2ced8dde582e049860a757ad0b7b09cf7548cc5f82e4233503c1ec460801c341c11b9b086709f503721b2479f699e5e545cd779e876946e48be10914f3a2ce9
- SSDEEP
  
  12288:wGZZW23TOmc1ZJ76vlHhM1N8bd+qUbtcY:17W23SbnJ0H6ebdapcY
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2