expiro | 8454272896648899194b4c898f40de35f42f915220410bef902a8e7a26d66e47 | Triage

Sharing

General

Target

JaffaCakes118_1a304f4b0e7f272133b7ddda62173bb8
Size

181KB
Sample

250222-rlpyjs1jz4
MD5

1a304f4b0e7f272133b7ddda62173bb8
SHA1

1a520e1d62b10473bbef2f3e619f06f6625ec2fa
SHA256

8454272896648899194b4c898f40de35f42f915220410bef902a8e7a26d66e47
SHA512

0221a4d840856d568b8f32177b27e9144c92f7a07166a2272bb3b6ebcd56aebdaeda7bceb780bcb68b8a7dd6f0c00e79107fd87ad81b068cd9659d131b05ac7a
SSDEEP

3072:o/8kkZycJU22DHyaLGKD7aQE+Kk1ThfYygs0yq/8h4j3OH1m4219ZQxyg5BhgDLy:Ec62cHzGqFKk1T/ghyl4uHuBS

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_1a304f4b0e7f272133b7ddda62173bb8
- Size
  
  181KB
- MD5
  
  1a304f4b0e7f272133b7ddda62173bb8
- SHA1
  
  1a520e1d62b10473bbef2f3e619f06f6625ec2fa
- SHA256
  
  8454272896648899194b4c898f40de35f42f915220410bef902a8e7a26d66e47
- SHA512
  
  0221a4d840856d568b8f32177b27e9144c92f7a07166a2272bb3b6ebcd56aebdaeda7bceb780bcb68b8a7dd6f0c00e79107fd87ad81b068cd9659d131b05ac7a
- SSDEEP
  
  3072:o/8kkZycJU22DHyaLGKD7aQE+Kk1ThfYygs0yq/8h4j3OH1m4219ZQxyg5BhgDLy:Ec62cHzGqFKk1T/ghyl4uHuBS
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2