expiro | 37dc70db147283426741695ed6a0b6ba982ef76b5b7a3f4612bcfb8c15d6feb1 | Triage

Sharing

General

Target

JaffaCakes118_042a66a8bcf085ed978b14070a1f2cc9
Size

181KB
Sample

250219-jetn6a1jgv
MD5

042a66a8bcf085ed978b14070a1f2cc9
SHA1

ae6c36f3fc39e58b15f071821e8665d05c985475
SHA256

37dc70db147283426741695ed6a0b6ba982ef76b5b7a3f4612bcfb8c15d6feb1
SHA512

b5e9345253a3f86bea214ae35656af4713007064b43631db636b6a8e4e7314917c1df1e29354d3732d0933f506f8a4df5004c875485c306e660e17214ff4746a
SSDEEP

3072:t/8kR4/YlwJn8OFbwg08HCIqeCDna99HcwLN93AM8+Y3b:N3mYCBxFEveOS98wYMm

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_042a66a8bcf085ed978b14070a1f2cc9
- Size
  
  181KB
- MD5
  
  042a66a8bcf085ed978b14070a1f2cc9
- SHA1
  
  ae6c36f3fc39e58b15f071821e8665d05c985475
- SHA256
  
  37dc70db147283426741695ed6a0b6ba982ef76b5b7a3f4612bcfb8c15d6feb1
- SHA512
  
  b5e9345253a3f86bea214ae35656af4713007064b43631db636b6a8e4e7314917c1df1e29354d3732d0933f506f8a4df5004c875485c306e660e17214ff4746a
- SSDEEP
  
  3072:t/8kR4/YlwJn8OFbwg08HCIqeCDna99HcwLN93AM8+Y3b:N3mYCBxFEveOS98wYMm
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2