expiro | f2f705611fd8aa687a95b7894cf7f291dd97f42c98993b49c2b6697f742c5d99 | Triage

Sharing

General

Target

JaffaCakes118_77eb78da2b46b9c15ec56c44eb888e80
Size

592KB
Sample

250104-f8ycnawrgr
MD5

77eb78da2b46b9c15ec56c44eb888e80
SHA1

99cd9bd277ead798a4e2f665a3aac530ab2965a8
SHA256

f2f705611fd8aa687a95b7894cf7f291dd97f42c98993b49c2b6697f742c5d99
SHA512

b0c1fd2f79966509b67fa58b2bbafb2c3ab81e68d5d5ca102c4c9938047b0426dd07c3e77ad0d1ecb3778c6e1fc412fde697d53c5a2e52bea16926be991940ad
SSDEEP

12288:b7T/h4tgIIhJ+SICqaPSgHmg5M/Dp5nVhq6mP1FQkDNXIDqpWSNdCt:b7T/0IhbBFSaYDp5nVkKKEZgct

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_77eb78da2b46b9c15ec56c44eb888e80
- Size
  
  592KB
- MD5
  
  77eb78da2b46b9c15ec56c44eb888e80
- SHA1
  
  99cd9bd277ead798a4e2f665a3aac530ab2965a8
- SHA256
  
  f2f705611fd8aa687a95b7894cf7f291dd97f42c98993b49c2b6697f742c5d99
- SHA512
  
  b0c1fd2f79966509b67fa58b2bbafb2c3ab81e68d5d5ca102c4c9938047b0426dd07c3e77ad0d1ecb3778c6e1fc412fde697d53c5a2e52bea16926be991940ad
- SSDEEP
  
  12288:b7T/h4tgIIhJ+SICqaPSgHmg5M/Dp5nVhq6mP1FQkDNXIDqpWSNdCt:b7T/0IhbBFSaYDp5nVkKKEZgct
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2