Overview

overview

10

Static

static

3

JaffaCakes...c3.exe

windows7-x64

10

JaffaCakes...c3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a66ee35d04b3f125d479a450d6a3adc3

  • Size

    241KB

  • Sample

    250118-lp88pszrfp

  • MD5

    a66ee35d04b3f125d479a450d6a3adc3

  • SHA1

    ceb743d8f8e901304899192c18b96f5a23098055

  • SHA256

    9c8f5e529aec8cbc4d2c1237a84d9ffd95b5bcb7cce8249ad13ba85aa2afc3cc

  • SHA512

    24543f5a0197c8d3baff0ac3e05770440633805df23a22304d2d43f6062e840c9d47b4784690ffc2c6bda9b125f091212385c34271e782352cb6eab28b28574e

  • SSDEEP

    3072:L3S8Iy/aNagTeo6isinQ6ZmQGU0yS+y2Q18mn6FEG57rEi7ri:FRri1z0ySL2Q18A6Ft5ci3i

Score
10/10
expirobackdoordiscoverypersistence

Malware Config

Targets

    • Target

      JaffaCakes118_a66ee35d04b3f125d479a450d6a3adc3

    • Size

      241KB

    • MD5

      a66ee35d04b3f125d479a450d6a3adc3

    • SHA1

      ceb743d8f8e901304899192c18b96f5a23098055

    • SHA256

      9c8f5e529aec8cbc4d2c1237a84d9ffd95b5bcb7cce8249ad13ba85aa2afc3cc

    • SHA512

      24543f5a0197c8d3baff0ac3e05770440633805df23a22304d2d43f6062e840c9d47b4784690ffc2c6bda9b125f091212385c34271e782352cb6eab28b28574e

    • SSDEEP

      3072:L3S8Iy/aNagTeo6isinQ6ZmQGU0yS+y2Q18mn6FEG57rEi7ri:FRri1z0ySL2Q18A6Ft5ci3i

    Score
    10/10
    expirobackdoordiscoverypersistence

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks