Overview

overview

10

Static

static

3

JaffaCakes...be.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-01-2025 14:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_caec7537cc2e20c886283c6fe13dfabe.exe

  • Size

    432KB

  • MD5

    caec7537cc2e20c886283c6fe13dfabe

  • SHA1

    63518685ae0b2ee845bb57dbcb329d9190a8d3b0

  • SHA256

    950f8eaf859ebfab5d29de8aee5cc4785b433ab1d448a213ea687fa9032e956f

  • SHA512

    ad74aebbce6224f6e264fd4c2ed03341ef837af7ccadaf64a76cd49007de98da8facac5672da167e05b654a22f365b8b04a2ca6d6df472aee90ab3f3095cdfc3

  • SSDEEP

    12288:sUCmZiC93QAbOOEDXJ/pnP+/v0PdBPaMlM9SPyYyAO:qC9gAKOED5/pe4dySJZ

Score
10/10
expirobackdoor

Malware Config

Signatures

  • Expiro family
    expiro
  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 4 IoCs
    backdoor

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_caec7537cc2e20c886283c6fe13dfabe.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_caec7537cc2e20c886283c6fe13dfabe.exe"
    1⤵
      PID:880

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/880-0-0x0000000000470000-0x0000000000504000-memory.dmp

      Filesize

      592KB

      Download

    • memory/880-1-0x0000000000400000-0x0000000000504000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/880-3-0x0000000000400000-0x0000000000504000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/880-2-0x0000000000470000-0x0000000000504000-memory.dmp

      Filesize

      592KB

      Download