Overview

overview

10

Static

static

3

JaffaCakes...86.exe

windows7-x64

10

JaffaCakes...86.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08-01-2025 00:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_80a4f69e04c5a5a762de420db6620386.exe

  • Size

    415KB

  • MD5

    80a4f69e04c5a5a762de420db6620386

  • SHA1

    e46291f402d3367a1458ae593f0363257a92a25f

  • SHA256

    c196a92295afeefc9243906a72232fc744304b6c74e7f09662b47c9b1e5565f8

  • SHA512

    07dfacf5a2c7efbd7ce171df41b607d7528bb8790fb1e89dd5ffd976aae07f77e3dc1f664b6d62f0dc519059708993896bba638354a88e11d7a623c1594c88e6

  • SSDEEP

    12288:5r1yKsipjNnlaFFxnc2K5Q2CLrbDy3/+4:5r1yKsilMFxc2KSjXD4h

Score
10/10
expirobackdoor

Malware Config

Signatures

  • Expiro family
    expiro
  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 4 IoCs
    backdoor

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80a4f69e04c5a5a762de420db6620386.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80a4f69e04c5a5a762de420db6620386.exe"
    1⤵
      PID:2452

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2452-0-0x000000000010B000-0x000000000019E000-memory.dmp

      Filesize

      588KB

      Download

    • memory/2452-1-0x000000000010B000-0x000000000019E000-memory.dmp

      Filesize

      588KB

      Download

    • memory/2452-2-0x00000000000A0000-0x000000000019E000-memory.dmp

      Filesize

      1016KB

      Download

    • memory/2452-3-0x00000000000A0000-0x000000000019E000-memory.dmp

      Filesize

      1016KB

      Download