expiro | f1f226acc5a3d25ea2307040157d2c8526f4e00d8aca28e88d274cb7e2b32426 | Triage

Sharing

General

Target

JaffaCakes118_008b51b90ef765f95752df2009e1dd10
Size

619KB
Sample

250218-syd79asndz
MD5

008b51b90ef765f95752df2009e1dd10
SHA1

547f765b8a51e0e9b7d60a36f891b4293e43eedf
SHA256

f1f226acc5a3d25ea2307040157d2c8526f4e00d8aca28e88d274cb7e2b32426
SHA512

903a2dd59ab9545649fa3cac4e1795bec1ae27128e074a808aae1239ea7ebb011111604ca86b651ffb2eaf9196eb1e11102d466330e07467e24894b2597fdcdd
SSDEEP

12288:/XnOq35zQ+/h1b3iAM/MKL3A2JikCa+RauryOIQrokKb6ATLat+J4F+P:/XOq32+/nb3it/MKLQ2Jikr+RauryOIF

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_008b51b90ef765f95752df2009e1dd10
- Size
  
  619KB
- MD5
  
  008b51b90ef765f95752df2009e1dd10
- SHA1
  
  547f765b8a51e0e9b7d60a36f891b4293e43eedf
- SHA256
  
  f1f226acc5a3d25ea2307040157d2c8526f4e00d8aca28e88d274cb7e2b32426
- SHA512
  
  903a2dd59ab9545649fa3cac4e1795bec1ae27128e074a808aae1239ea7ebb011111604ca86b651ffb2eaf9196eb1e11102d466330e07467e24894b2597fdcdd
- SSDEEP
  
  12288:/XnOq35zQ+/h1b3iAM/MKL3A2JikCa+RauryOIQrokKb6ATLat+J4F+P:/XOq32+/nb3it/MKLQ2Jikr+RauryOIF
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2