expiro | 1cbd6ed203974818935c421867ef7210c1ae9b873cd5f2610d754f245630ba72 | Triage

Sharing

General

Target

JaffaCakes118_036492e794d3bd7288c94dde82e1623a
Size

299KB
Sample

250219-exz7faxjey
MD5

036492e794d3bd7288c94dde82e1623a
SHA1

c06612dbeefeefdddce0a115f240c427d238b630
SHA256

1cbd6ed203974818935c421867ef7210c1ae9b873cd5f2610d754f245630ba72
SHA512

ef16f2a80bbca6d82dfe60e6a3c2e9fcf16493110f993cfe9789b85d2dd418239d69881c6a5ae4c27449af2ec8b079c8fc154ca19be242dfc51b9d812ad4125f
SSDEEP

6144:lmEInRXghTpq8usq/1JT2uy9QgRgFevmtEPfNdx+l28Vid4w9oR4Z52ZkD9vfSX:lXQOq357UvmtEXNb+l284doUakZy

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_036492e794d3bd7288c94dde82e1623a
- Size
  
  299KB
- MD5
  
  036492e794d3bd7288c94dde82e1623a
- SHA1
  
  c06612dbeefeefdddce0a115f240c427d238b630
- SHA256
  
  1cbd6ed203974818935c421867ef7210c1ae9b873cd5f2610d754f245630ba72
- SHA512
  
  ef16f2a80bbca6d82dfe60e6a3c2e9fcf16493110f993cfe9789b85d2dd418239d69881c6a5ae4c27449af2ec8b079c8fc154ca19be242dfc51b9d812ad4125f
- SSDEEP
  
  6144:lmEInRXghTpq8usq/1JT2uy9QgRgFevmtEPfNdx+l28Vid4w9oR4Z52ZkD9vfSX:lXQOq357UvmtEXNb+l284doUakZy
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2