General

  • Target

    JaffaCakes118_7a00e6e0a7fafe783537a2f884b849ee

  • Size

    60KB

  • Sample

    250316-m64j8ayze1

  • MD5

    7a00e6e0a7fafe783537a2f884b849ee

  • SHA1

    88a6ed96a23488f75cf8ee869f1dd12f0157c546

  • SHA256

    4dda70fa6c92113a2750d34f78ce2d4b72361a6306b5309a7dba951ef2d4db09

  • SHA512

    b17606485e8a8c34129b9e5e0253665e1595d36335a6015e2c4e14bffb1185574c2423b9625e0a8e174ca80b2357f2b1d18f2e2f2fcd8c5a3ec429750c1968ff

  • SSDEEP

    768:yE30e/7tEaWcArSwaydTb0EroSd3QXGsBS4sZFFSUv6GfEK+RsWW2qTN4lvCy2ZL:v+PeXonnUStQXDI4spvVp+N8NECtH3T

Malware Config

Targets

    • Target

      JaffaCakes118_7a00e6e0a7fafe783537a2f884b849ee

    • Size

      60KB

    • MD5

      7a00e6e0a7fafe783537a2f884b849ee

    • SHA1

      88a6ed96a23488f75cf8ee869f1dd12f0157c546

    • SHA256

      4dda70fa6c92113a2750d34f78ce2d4b72361a6306b5309a7dba951ef2d4db09

    • SHA512

      b17606485e8a8c34129b9e5e0253665e1595d36335a6015e2c4e14bffb1185574c2423b9625e0a8e174ca80b2357f2b1d18f2e2f2fcd8c5a3ec429750c1968ff

    • SSDEEP

      768:yE30e/7tEaWcArSwaydTb0EroSd3QXGsBS4sZFFSUv6GfEK+RsWW2qTN4lvCy2ZL:v+PeXonnUStQXDI4spvVp+N8NECtH3T

    • Expiro family

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

    • Expiro payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks