expiro | 609055c9b7257aeb37717468a21d43cf2bd18f642bc548d2a4c99fd2d9e238d3 | Triage

Sharing

General

Target

JaffaCakes118_78de12fdfb0f6b659d13fb49cdb074b0
Size

560KB
Sample

250104-k7yz1ssrbt
MD5

78de12fdfb0f6b659d13fb49cdb074b0
SHA1

8a29e0cd147979dcea7cb23e0fface2cc0851cd3
SHA256

609055c9b7257aeb37717468a21d43cf2bd18f642bc548d2a4c99fd2d9e238d3
SHA512

4f35bc0b085f18c497b8864832042db71174426f121b1787e929b5ff700f3c83a14fa3f3d44e3b29564aa612bcdb19942f3461fd450ec808e0af75d6631427aa
SSDEEP

12288:AjycEQJwbIA25yKlGdfMA0EGhbY32Lelh+I32xAlxADlcQ/o:Ajy2Jw525RGdfMA0EGpY3QelUI32xAlT

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_78de12fdfb0f6b659d13fb49cdb074b0
- Size
  
  560KB
- MD5
  
  78de12fdfb0f6b659d13fb49cdb074b0
- SHA1
  
  8a29e0cd147979dcea7cb23e0fface2cc0851cd3
- SHA256
  
  609055c9b7257aeb37717468a21d43cf2bd18f642bc548d2a4c99fd2d9e238d3
- SHA512
  
  4f35bc0b085f18c497b8864832042db71174426f121b1787e929b5ff700f3c83a14fa3f3d44e3b29564aa612bcdb19942f3461fd450ec808e0af75d6631427aa
- SSDEEP
  
  12288:AjycEQJwbIA25yKlGdfMA0EGhbY32Lelh+I32xAlxADlcQ/o:Ajy2Jw525RGdfMA0EGpY3QelUI32xAlT
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2