expiro | 5090b93e1043d275ac78ef423efa54b3a747a7eb62947418d596e4d09648f53f | Triage

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 19:25

Sharing

Report Analysis Logs

General

Target

JaffaCakes118_d0627254b3cc078e39bf5ea64273b3b9.exe
Size

432KB
MD5

d0627254b3cc078e39bf5ea64273b3b9
SHA1

09023bb01e06128d268b051033857a5c9ab35eb3
SHA256

5090b93e1043d275ac78ef423efa54b3a747a7eb62947418d596e4d09648f53f
SHA512

977514f0b037fedade9c33c88dd2532d8a5e3984f7c0e2a78b4dec62731b55258a4826b5053ba9df9494b4dd2bbd8574b129a6a32d98ad0c15f02eba79ca9818
SSDEEP

12288:JUCmZiCmnSNuCNCx0L311B9mPDB7IiNvp:zCmSNuU3lk9FN

Score

10^/10

expiro backdoor

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 3 IoCs

resource	yara_rule
behavioral1/memory/3536-0-0x0000000000470000-0x0000000000504000-memory.dmp	family_expiro1
behavioral1/memory/3536-1-0x0000000000470000-0x0000000000504000-memory.dmp	family_expiro1
behavioral1/memory/3536-2-0x0000000000400000-0x0000000000504000-memory.dmp	family_expiro1

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0627254b3cc078e39bf5ea64273b3b9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0627254b3cc078e39bf5ea64273b3b9.exe"
1⤵
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3536-0-0x0000000000470000-0x0000000000504000-memory.dmp

Filesize
592KB

Download
memory/3536-1-0x0000000000470000-0x0000000000504000-memory.dmp

Filesize
592KB

Download
memory/3536-2-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/3536-3-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download