Overview

overview

10

Static

static

3

308f86a579...cd.exe

windows7-x64

10

308f86a579...cd.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    308f86a5791eddb3ad7e70684220e9440a9d77d263adfc8db0ad8fd253eeb2cd

  • Size

    738KB

  • Sample

    250120-r5w6zavjaz

  • MD5

    1ffd1c53b2738258c5b1028d22e70f6f

  • SHA1

    3b69a4874b9751a12fe76c8a1d44bf260e590991

  • SHA256

    308f86a5791eddb3ad7e70684220e9440a9d77d263adfc8db0ad8fd253eeb2cd

  • SHA512

    738518abe28406963cad86ec0c6e1807a1bc28aadd614c0766f48a84ebe8655733d257449c37520f731b40c50020e0f668585b1fad660988d321ce7857b36c08

  • SSDEEP

    12288:g9mmpcK5VEjObxrx84BdEPSsKRIkgq/2oW0Qtn+nd62puFuNtyg2nIh/Qkge:g9mmqK5VEjObxrx84BdEPARIVqs0QQtr

Score
10/10
expirobackdoordefense_evasiondiscoverytrojan

Malware Config

Targets

    • Target

      308f86a5791eddb3ad7e70684220e9440a9d77d263adfc8db0ad8fd253eeb2cd

    • Size

      738KB

    • MD5

      1ffd1c53b2738258c5b1028d22e70f6f

    • SHA1

      3b69a4874b9751a12fe76c8a1d44bf260e590991

    • SHA256

      308f86a5791eddb3ad7e70684220e9440a9d77d263adfc8db0ad8fd253eeb2cd

    • SHA512

      738518abe28406963cad86ec0c6e1807a1bc28aadd614c0766f48a84ebe8655733d257449c37520f731b40c50020e0f668585b1fad660988d321ce7857b36c08

    • SSDEEP

      12288:g9mmpcK5VEjObxrx84BdEPSsKRIkgq/2oW0Qtn+nd62puFuNtyg2nIh/Qkge:g9mmqK5VEjObxrx84BdEPARIVqs0QQtr

    Score
    10/10
    expirobackdoordefense_evasiondiscoverytrojan

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Disables taskbar notifications via registry modification

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      defense_evasiontrojan

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks