expiro | 052cfa949ab7309b85dbba86a6c05b907ab344f67fde1fcbcd4d6885e5b72084 | Triage

Sharing

General

Target

JaffaCakes118_1aa27a9942c1d9c0a9f3dda907ff9327
Size

181KB
Sample

250222-s44p4avlt8
MD5

1aa27a9942c1d9c0a9f3dda907ff9327
SHA1

8d6051fd51dec2d4845f06c76e9f1e82178ce305
SHA256

052cfa949ab7309b85dbba86a6c05b907ab344f67fde1fcbcd4d6885e5b72084
SHA512

9854e23b7aaf2382cfb630449e6fc87965c625de6b55841ef0c52caad3e3375f3cb5c98c831703ccc4fbd4c530665bb70b236f15a947fa11e14a537c1fc9440b
SSDEEP

3072:4/8k8NVKNYZV3DEr71U8xkdIpMG/qcWPvCo5aCDsO+v03bs2W3:USNVXZVYV/qNPv9azZ2W3

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_1aa27a9942c1d9c0a9f3dda907ff9327
- Size
  
  181KB
- MD5
  
  1aa27a9942c1d9c0a9f3dda907ff9327
- SHA1
  
  8d6051fd51dec2d4845f06c76e9f1e82178ce305
- SHA256
  
  052cfa949ab7309b85dbba86a6c05b907ab344f67fde1fcbcd4d6885e5b72084
- SHA512
  
  9854e23b7aaf2382cfb630449e6fc87965c625de6b55841ef0c52caad3e3375f3cb5c98c831703ccc4fbd4c530665bb70b236f15a947fa11e14a537c1fc9440b
- SSDEEP
  
  3072:4/8k8NVKNYZV3DEr71U8xkdIpMG/qcWPvCo5aCDsO+v03bs2W3:USNVXZVYV/qNPv9azZ2W3
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2