expiro | bffeacc272c9dd5eb19a51ade982a8b77e3321c621332caaaecc15242e174a6b | Triage

Sharing

General

Target

JaffaCakes118_06b50cafeae38fc386c31bc053012950
Size

197KB
Sample

250219-vpkd1svmhs
MD5

06b50cafeae38fc386c31bc053012950
SHA1

da9ca2ba5fea4af5f428326f6f05c140f4c5867d
SHA256

bffeacc272c9dd5eb19a51ade982a8b77e3321c621332caaaecc15242e174a6b
SHA512

a1ea1f4772dacb971073ef538ec76e3f96e7e71e8e780d6ef57dc1d410ebc5fe01f55d1812f1cfbe67f3337f283735b704c35c68ccf9323ae0534f94ec7842f0
SSDEEP

3072:6ikHWMQLu73X48GBrzMZc4cjKfvgzjy3DOtjEyoA/crmcd/dymDP8wdmX4O:6YMQL+3XKrF4HgfymN1kyyyyPX+4

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_06b50cafeae38fc386c31bc053012950
- Size
  
  197KB
- MD5
  
  06b50cafeae38fc386c31bc053012950
- SHA1
  
  da9ca2ba5fea4af5f428326f6f05c140f4c5867d
- SHA256
  
  bffeacc272c9dd5eb19a51ade982a8b77e3321c621332caaaecc15242e174a6b
- SHA512
  
  a1ea1f4772dacb971073ef538ec76e3f96e7e71e8e780d6ef57dc1d410ebc5fe01f55d1812f1cfbe67f3337f283735b704c35c68ccf9323ae0534f94ec7842f0
- SSDEEP
  
  3072:6ikHWMQLu73X48GBrzMZc4cjKfvgzjy3DOtjEyoA/crmcd/dymDP8wdmX4O:6YMQL+3XKrF4HgfymN1kyyyyPX+4
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2