expiro | 155ba2df7e1adf083b03fa72dab3bb9dba7c952524d34f5b5f118eab66b676f4 | Triage

Sharing

General

Target

JaffaCakes118_1e5821d7224e4b03e70ab75a6fed47b2
Size

181KB
Sample

250223-ej5vrsxjfn
MD5

1e5821d7224e4b03e70ab75a6fed47b2
SHA1

05e5b92c570f74c33c3d5946de42bc4bf217a616
SHA256

155ba2df7e1adf083b03fa72dab3bb9dba7c952524d34f5b5f118eab66b676f4
SHA512

cd3db5d76697ec11d59970fc5a69b37c830aed597ee8556316453ff13cf351655701a7eabd43b840fbb6004aca46ed5d69b886dba79e9ed1380804ad7243f745
SSDEEP

3072:8/8kE0zRKjl1PewbrnBt/rCVHOg9nEx8RW/4CScR45J36nXcLULAG67aXq:4+0VKp1PeSrP/uVTntvq45J36nXcQm

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_1e5821d7224e4b03e70ab75a6fed47b2
- Size
  
  181KB
- MD5
  
  1e5821d7224e4b03e70ab75a6fed47b2
- SHA1
  
  05e5b92c570f74c33c3d5946de42bc4bf217a616
- SHA256
  
  155ba2df7e1adf083b03fa72dab3bb9dba7c952524d34f5b5f118eab66b676f4
- SHA512
  
  cd3db5d76697ec11d59970fc5a69b37c830aed597ee8556316453ff13cf351655701a7eabd43b840fbb6004aca46ed5d69b886dba79e9ed1380804ad7243f745
- SSDEEP
  
  3072:8/8kE0zRKjl1PewbrnBt/rCVHOg9nEx8RW/4CScR45J36nXcLULAG67aXq:4+0VKp1PeSrP/uVTntvq45J36nXcQm
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2