Overview

overview

10

Static

static

3

c18d5823f4...4d.exe

windows7-x64

10

c18d5823f4...4d.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_79e86a6b753911c6e2c061abbf7de210

  • Size

    657KB

  • Sample

    250104-qmch6s1lb1

  • MD5

    79e86a6b753911c6e2c061abbf7de210

  • SHA1

    0b501daba9d469a33b282867e9a4f0825e234a65

  • SHA256

    d9be5a0bb7c45888353a70b44b7667519a41c73c15ae2cab1a21fe32ab90f13e

  • SHA512

    28b0c7868d002f039fdec3048c21ec20b1bf0d818d7152c74f8a6963d034612f9569886d07bd4177e227acc01ca70528f98d636e33f03a4cce9e611522607772

  • SSDEEP

    12288:2Zd4GBqnEx5GvnR+DLahlANLWBWIxsc9yDADM0WMLm0ZLpWAFDYeWOM/:2vFYq5k05CBVqDGpLpWAFDvWOc

Score
10/10
expirobackdoorcredential_accessdiscoveryevasionstealertrojan

Malware Config

Targets

    • Target

      c18d5823f4808a892653eb231e6927e0df8e6e4d

    • Size

      956KB

    • MD5

      7fe31af4adb4df5f9068b74e66b56ccc

    • SHA1

      c18d5823f4808a892653eb231e6927e0df8e6e4d

    • SHA256

      a41f5ab28e2e2112625fb13286ff060b3be5a42d1f164c56b7ef43bdaff9ddaf

    • SHA512

      a08469694816dd71e19a48fea95954a700a5a09931c713afa2be181ce581600f962b2bfd0552aa016dfddd892004ae178798948cba1aadb3e979e48dd9a2b3ca

    • SSDEEP

      24576:ufWUtLpwbtLpwCyQyJQG0oJwvRDY95pWAFD1WO:CbtL2tLG/eM5pj

    Score
    10/10
    expirobackdoorcredential_accessdiscoveryevasionstealertrojan

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Disables taskbar notifications via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Windows security modification

      evasiontrojan

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks