expiro | 7fcb57776b43903ab5057303b2dbee8b82bbedbb9c79590e04c6c973bdf49d85 | Triage

Sharing

General

Target

JaffaCakes118_7a3791f2ac44574cd7068681af0ce383
Size

181KB
Sample

250104-rwynfatkgw
MD5

7a3791f2ac44574cd7068681af0ce383
SHA1

9c8cec68967597e78363438a63ab3a5b162a62e4
SHA256

7fcb57776b43903ab5057303b2dbee8b82bbedbb9c79590e04c6c973bdf49d85
SHA512

dbe46fc6c797b70d6fc5cbd8e2f652bfb52c283dabfb985f75d90a12fd31fca6f377edb1c0208a375f875a0365a2c4011f7cb2663276bd11c78ba6d9b9666f34
SSDEEP

3072:J/8kV/MNJtAsyqS0JP9EBztZjdFoxxsvLK3HqGLTUgWayQEJDx2bg9aX8ax5iZ08:Zr/MNJtAsFS0JP9EBRR8xxsvLPGLdyrv

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_7a3791f2ac44574cd7068681af0ce383
- Size
  
  181KB
- MD5
  
  7a3791f2ac44574cd7068681af0ce383
- SHA1
  
  9c8cec68967597e78363438a63ab3a5b162a62e4
- SHA256
  
  7fcb57776b43903ab5057303b2dbee8b82bbedbb9c79590e04c6c973bdf49d85
- SHA512
  
  dbe46fc6c797b70d6fc5cbd8e2f652bfb52c283dabfb985f75d90a12fd31fca6f377edb1c0208a375f875a0365a2c4011f7cb2663276bd11c78ba6d9b9666f34
- SSDEEP
  
  3072:J/8kV/MNJtAsyqS0JP9EBztZjdFoxxsvLK3HqGLTUgWayQEJDx2bg9aX8ax5iZ08:Zr/MNJtAsFS0JP9EBRR8xxsvLPGLdyrv
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2