expiro | d3c06b7564d9654b767c3490d5f4aff8b66153f502e68d89efcca25570a3a740 | Triage

Sharing

General

Target

JaffaCakes118_00128bb9dc6362f44ccb05d7f54f57a0
Size

315KB
Sample

250218-qmn7za1jek
MD5

00128bb9dc6362f44ccb05d7f54f57a0
SHA1

87e4beb9633057064bddcd81341c2e54eb193e92
SHA256

d3c06b7564d9654b767c3490d5f4aff8b66153f502e68d89efcca25570a3a740
SHA512

abd4269b8bf60a17e04dd51bf972f02435abd04cf9bd1392d4eb3550cd5cdcd83b6154c8be4ffd879539ed9d8850e7498ffd5d71f1a780c589d81ce07bb03072
SSDEEP

6144:umEInRXghTjq8usq/1JT2uy9QckWkc1z9xfjsyuKj7trjVylESvIVAJ/A:uXqOq35Kk6xdjVyHvIV4A

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_00128bb9dc6362f44ccb05d7f54f57a0
- Size
  
  315KB
- MD5
  
  00128bb9dc6362f44ccb05d7f54f57a0
- SHA1
  
  87e4beb9633057064bddcd81341c2e54eb193e92
- SHA256
  
  d3c06b7564d9654b767c3490d5f4aff8b66153f502e68d89efcca25570a3a740
- SHA512
  
  abd4269b8bf60a17e04dd51bf972f02435abd04cf9bd1392d4eb3550cd5cdcd83b6154c8be4ffd879539ed9d8850e7498ffd5d71f1a780c589d81ce07bb03072
- SSDEEP
  
  6144:umEInRXghTjq8usq/1JT2uy9QckWkc1z9xfjsyuKj7trjVylESvIVAJ/A:uXqOq35Kk6xdjVyHvIV4A
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2