expiro | 9bf826bbb4f89952b2c9da4452d171954d49b766931a435b7b2e8a12eda9a9cf | Triage

Sharing

General

Target

JaffaCakes118_7bd7057991bddad5ed9553253bd752d2
Size

505KB
Sample

250104-1bcd5syjbz
MD5

7bd7057991bddad5ed9553253bd752d2
SHA1

77f5f9cf6465f421167e2d5dd40f5893f2e2ce01
SHA256

9bf826bbb4f89952b2c9da4452d171954d49b766931a435b7b2e8a12eda9a9cf
SHA512

27134023416949200e35f05a8b607ca1825fe6b7ea611e45844264f0e1b37e51a9572ecf1dcc6247926fb4a23e259f32840ae97ef9c993d278a66c6705b02599
SSDEEP

12288:Kl1yAJjoDPSyGo+/seDuVMEhfEaSs8MFZ3l7piy5K9WY+x:+1/JjoDayG4NhCo3Xiy09Wx

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_7bd7057991bddad5ed9553253bd752d2
- Size
  
  505KB
- MD5
  
  7bd7057991bddad5ed9553253bd752d2
- SHA1
  
  77f5f9cf6465f421167e2d5dd40f5893f2e2ce01
- SHA256
  
  9bf826bbb4f89952b2c9da4452d171954d49b766931a435b7b2e8a12eda9a9cf
- SHA512
  
  27134023416949200e35f05a8b607ca1825fe6b7ea611e45844264f0e1b37e51a9572ecf1dcc6247926fb4a23e259f32840ae97ef9c993d278a66c6705b02599
- SSDEEP
  
  12288:Kl1yAJjoDPSyGo+/seDuVMEhfEaSs8MFZ3l7piy5K9WY+x:+1/JjoDayG4NhCo3Xiy09Wx
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2