Overview

overview

10

Static

static

3

JaffaCakes...90.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-01-2025 09:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_987ba2ff39246a5b5e0f5ac8dda26390.exe

  • Size

    432KB

  • MD5

    987ba2ff39246a5b5e0f5ac8dda26390

  • SHA1

    ac14e5cc493d250bd86ca2ce1d3717ff082c3ca0

  • SHA256

    d6c380b2877141b1f702c29901b50419ee08c6c45773139c71950977c5c4942c

  • SHA512

    61072c5366e698ee0a11dc98962a81be3fcba9089543cc6416eb082bd55ffc30cb929e853c9a2920316d44584d3b5c7efed3ad63e269785aa73b32efc3b063fb

  • SSDEEP

    6144:wFUCmZqoFWC6xjuG8lqkg5dUFoaHnfkwg2id3UKWeEVS7uRCWzByMj9P4e3gfz:cUCmZiCh7Ts+ffN4EIuvByMBAvb

Score
10/10
expirobackdoor

Malware Config

Signatures

  • Expiro family
    expiro
  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 3 IoCs
    backdoor

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_987ba2ff39246a5b5e0f5ac8dda26390.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_987ba2ff39246a5b5e0f5ac8dda26390.exe"
    1⤵
      PID:2248

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2248-0-0x0000000000470000-0x0000000000504000-memory.dmp

      Filesize

      592KB

      Download

    • memory/2248-2-0x0000000000400000-0x0000000000504000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/2248-1-0x0000000000470000-0x0000000000504000-memory.dmp

      Filesize

      592KB

      Download