expiro | 6d177210e8a0c508a402188cfc38f47cfde0fbbdab2272272ad6e0c8c565c248 | Triage

Sharing

General

Target

JaffaCakes118_04d01a58c5124c797b743920805aff99
Size

181KB
Sample

250219-l5kv2sypdm
MD5

04d01a58c5124c797b743920805aff99
SHA1

d3453460a2e946e477d0e166ee54c2ce64195806
SHA256

6d177210e8a0c508a402188cfc38f47cfde0fbbdab2272272ad6e0c8c565c248
SHA512

e6225828f956ab2919e320daa68633b35d7bb1f04e472312b1d1ec8a2711f5dbe7d9861dddee0342493499b6d3350e87577545e9255cfbce2e77296f8d7c552c
SSDEEP

3072:z/8kPShtEnI3sEoOvW3lzCxkjnOejLwM7cMfBjyOQJq424Bw9fMJAzua84P4:7tShtEnI3JoOvwzOWlcuyPW4Bw1+Abd4

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_04d01a58c5124c797b743920805aff99
- Size
  
  181KB
- MD5
  
  04d01a58c5124c797b743920805aff99
- SHA1
  
  d3453460a2e946e477d0e166ee54c2ce64195806
- SHA256
  
  6d177210e8a0c508a402188cfc38f47cfde0fbbdab2272272ad6e0c8c565c248
- SHA512
  
  e6225828f956ab2919e320daa68633b35d7bb1f04e472312b1d1ec8a2711f5dbe7d9861dddee0342493499b6d3350e87577545e9255cfbce2e77296f8d7c552c
- SSDEEP
  
  3072:z/8kPShtEnI3sEoOvW3lzCxkjnOejLwM7cMfBjyOQJq424Bw9fMJAzua84P4:7tShtEnI3JoOvwzOWlcuyPW4Bw1+Abd4
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2