expiro | 148aaa894097a35f125dc0f9d10481773ffaf251975654f35413a617b1f5c29e | Triage

Sharing

General

Target

JaffaCakes118_1a836b1ea94941b4a245dae365e52c66
Size

276KB
Sample

250222-sqhkpssnar
MD5

1a836b1ea94941b4a245dae365e52c66
SHA1

431595e5b7cd9aff4ad68328e0af4ca4ba3ac8d5
SHA256

148aaa894097a35f125dc0f9d10481773ffaf251975654f35413a617b1f5c29e
SHA512

780ce3170ec6b8add804f02a3e3ff5ee76df270d9fb074cdb26a600cf951bc535c15bb95a4020533aae1a50c603c4085d875b82c603a2437c47c7fce6c306dc5
SSDEEP

6144:IiSGe/7LlNi8Mx63FOcmRZcBf27jAlf5qgveQIplH:IiSBXi8X2RSf27jEogve9pt

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_1a836b1ea94941b4a245dae365e52c66
- Size
  
  276KB
- MD5
  
  1a836b1ea94941b4a245dae365e52c66
- SHA1
  
  431595e5b7cd9aff4ad68328e0af4ca4ba3ac8d5
- SHA256
  
  148aaa894097a35f125dc0f9d10481773ffaf251975654f35413a617b1f5c29e
- SHA512
  
  780ce3170ec6b8add804f02a3e3ff5ee76df270d9fb074cdb26a600cf951bc535c15bb95a4020533aae1a50c603c4085d875b82c603a2437c47c7fce6c306dc5
- SSDEEP
  
  6144:IiSGe/7LlNi8Mx63FOcmRZcBf27jAlf5qgveQIplH:IiSBXi8X2RSf27jEogve9pt
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2