expiro | eefc75eb3fd82274bd773834c3c89afe90cb59cdd052aaa1d5b2ee100e0c0313 | Triage

Sharing

General

Target

JaffaCakes118_06eaa1aca50233997d71bf1cdb61b5bf
Size

299KB
Sample

250219-wlpd8swjgw
MD5

06eaa1aca50233997d71bf1cdb61b5bf
SHA1

dae21e926abdc110a99e1b7acd155c3e3f133d35
SHA256

eefc75eb3fd82274bd773834c3c89afe90cb59cdd052aaa1d5b2ee100e0c0313
SHA512

c01ef3a1f28ec4ba08629fdb008f9baf542c32e485c8107ecf45c908bc163c2b15da0f9e0afcf607c510772c4de861b233a8811205d0b6d0b8a2e31c64f2048e
SSDEEP

6144:lmEInRXghT4q8usq/1JT2uy9Q4kl1GTaolFJ9OV7nXygzV:lXVOq35ybTao/O1

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_06eaa1aca50233997d71bf1cdb61b5bf
- Size
  
  299KB
- MD5
  
  06eaa1aca50233997d71bf1cdb61b5bf
- SHA1
  
  dae21e926abdc110a99e1b7acd155c3e3f133d35
- SHA256
  
  eefc75eb3fd82274bd773834c3c89afe90cb59cdd052aaa1d5b2ee100e0c0313
- SHA512
  
  c01ef3a1f28ec4ba08629fdb008f9baf542c32e485c8107ecf45c908bc163c2b15da0f9e0afcf607c510772c4de861b233a8811205d0b6d0b8a2e31c64f2048e
- SSDEEP
  
  6144:lmEInRXghT4q8usq/1JT2uy9Q4kl1GTaolFJ9OV7nXygzV:lXVOq35ybTao/O1
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2