Overview

overview

10

Static

static

3

JaffaCakes...9a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-01-2025 09:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_9c388b450d20f0b42c5ed2029a01899a.exe

  • Size

    432KB

  • MD5

    9c388b450d20f0b42c5ed2029a01899a

  • SHA1

    13606731c1c19d24f39adc96e996bd3e5bbf26dd

  • SHA256

    6fe7e11bba8b8868a4130ae1e6afd296ac7bace3de03d20ce9d470d6cd906f83

  • SHA512

    fe0b1029f10bc4088ccf912eee65c88ba5e6d62bf75a2f29aec3f291c34989d91eeb71db16e757e11da66ac707ccee98e474bc71d6489dc05d4c14c61c401c7b

  • SSDEEP

    6144:wFUCmZqoFWC6x6lzF6cnjKwa9qgl/A37b2fZwSYUI0ZxA9XxAgsBhSRsuR3tWJHz:cUCmZiC31FjK2rbpgZx8Xx2kRvtWJ7/

Score
10/10
expirobackdoor

Malware Config

Signatures

  • Expiro family
    expiro
  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 4 IoCs
    backdoor

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9c388b450d20f0b42c5ed2029a01899a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9c388b450d20f0b42c5ed2029a01899a.exe"
    1⤵
      PID:64

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/64-0-0x0000000000470000-0x0000000000504000-memory.dmp

      Filesize

      592KB

      Download

    • memory/64-1-0x0000000000470000-0x0000000000504000-memory.dmp

      Filesize

      592KB

      Download

    • memory/64-2-0x0000000000400000-0x0000000000504000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/64-3-0x0000000000400000-0x0000000000504000-memory.dmp

      Filesize

      1.0MB

      Download