General

  • Target

    JaffaCakes118_9ee141f0942a465be5f751b84fda38b6

  • Size

    140KB

  • Sample

    250407-nd6dsazns2

  • MD5

    9ee141f0942a465be5f751b84fda38b6

  • SHA1

    b187978a7a78263be56f52d500be5b99f74a2925

  • SHA256

    54b49d4e91f8acb202abdb1eceeec91635bf075ccfd5f9e1a974ad0eb735f27f

  • SHA512

    3b39e59b99cdd5c17c551746147d6202e3c6a2bb1c8f5de719d6b02d75c59680dc3428fd6072a2a7adc54ffbe00b967e04e3c9e87e5346077ed845f7191afa20

  • SSDEEP

    3072:3Dp+vUbDlkCJ7gXueb/cCq/FlSewph0GXbG34t:8vUbZkceLFGlSHh04br

Malware Config

Targets

    • Target

      JaffaCakes118_9ee141f0942a465be5f751b84fda38b6

    • Size

      140KB

    • MD5

      9ee141f0942a465be5f751b84fda38b6

    • SHA1

      b187978a7a78263be56f52d500be5b99f74a2925

    • SHA256

      54b49d4e91f8acb202abdb1eceeec91635bf075ccfd5f9e1a974ad0eb735f27f

    • SHA512

      3b39e59b99cdd5c17c551746147d6202e3c6a2bb1c8f5de719d6b02d75c59680dc3428fd6072a2a7adc54ffbe00b967e04e3c9e87e5346077ed845f7191afa20

    • SSDEEP

      3072:3Dp+vUbDlkCJ7gXueb/cCq/FlSewph0GXbG34t:8vUbZkceLFGlSHh04br

    • Expiro family

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

    • Expiro payload

    • Executes dropped EXE

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks