expiro | 2c128bc884206cef7e28ab55194de151ba47ba903891b8860030b533144f69db | Triage

Sharing

General

Target

JaffaCakes118_213030da6c00dbba02dfc23a754410fa
Size

299KB
Sample

250223-rpshvaslt9
MD5

213030da6c00dbba02dfc23a754410fa
SHA1

5ad7450f91609d20a097b1ff3f85e51869b76ad1
SHA256

2c128bc884206cef7e28ab55194de151ba47ba903891b8860030b533144f69db
SHA512

1e10490a3973576604995246e1db9d0334d590070409f8913877391336d1930c6c8ee26b00a36417a85c5567b15631a99b888858a1eb4d61f87fffc8407d4e7b
SSDEEP

6144:7mEInRXghTKq8usq/1k/ONt9QIhKwbmzJA/ozDScE7hAJu+HXIcSUE:7XXOqySphKNfnPuG4cSU

Score

10^/10

expiro backdoor discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_213030da6c00dbba02dfc23a754410fa
- Size
  
  299KB
- MD5
  
  213030da6c00dbba02dfc23a754410fa
- SHA1
  
  5ad7450f91609d20a097b1ff3f85e51869b76ad1
- SHA256
  
  2c128bc884206cef7e28ab55194de151ba47ba903891b8860030b533144f69db
- SHA512
  
  1e10490a3973576604995246e1db9d0334d590070409f8913877391336d1930c6c8ee26b00a36417a85c5567b15631a99b888858a1eb4d61f87fffc8407d4e7b
- SSDEEP
  
  6144:7mEInRXghTKq8usq/1k/ONt9QIhKwbmzJA/ozDScE7hAJu+HXIcSUE:7XXOqySphKNfnPuG4cSU
Score

10^/10

expiro backdoor discovery
- Expiro family
  expiro
- Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Expiro payload
  backdoor
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

expirobackdoordiscovery

behavioral2