expiro | 230154a9a68cc4731da10b578e40b40870a6023079e5510d795513eaa31d972c

General

Target
2026-08-03_6545facc7572754fc452835ad2224c7c_amadey_elex_luca-stealer_njrat_smoke-loader
Size 2.0MB
Sample260803-wk9nsadc95
SHA256 230154a9a68cc4731da10b578e40b40870a6023079e5510d795513eaa31d972c
MD5 6545facc7572754fc452835ad2224c7c
SHA1 3e3c5a98da1ad33f409ce61bbe1f28233264433e
SHA512 d9ab5e7e7ccb6e0e24c452e530811eeccccb0c8a05a4f4c1640c89578ed705e47a8d3682643cbb175dd01de796739fc1316679f0b3e250b12f31aeaa7b19395e
SSDEEP 24576:YGhWem1gXq5L9uSWidgpm6hbpOSRKQuEkFb3Gr7QT2uALxZqC50B1cJKNSfNUaF:YaXq5L9uiibpJKQjkkOA3qHYTfNUaF
TLSH
T11FA56C0DA761502CFDF305FA4AFE23ACA82DBDA0076890D352C426DED725AE57D36253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_6545facc7572754fc452835ad2224c7c_amadey_elex_luca-stealer_njrat_smoke-loader
- Size 2.0MB
- SHA256 230154a9a68cc4731da10b578e40b40870a6023079e5510d795513eaa31d972c
- MD5 6545facc7572754fc452835ad2224c7c
- SHA1 3e3c5a98da1ad33f409ce61bbe1f28233264433e
- SHA512 d9ab5e7e7ccb6e0e24c452e530811eeccccb0c8a05a4f4c1640c89578ed705e47a8d3682643cbb175dd01de796739fc1316679f0b3e250b12f31aeaa7b19395e
- SSDEEP 24576:YGhWem1gXq5L9uSWidgpm6hbpOSRKQuEkFb3Gr7QT2uALxZqC50B1cJKNSfNUaF:YaXq5L9uiibpJKQjkkOA3qHYTfNUaF
- TLSH
  T11FA56C0DA761502CFDF305FA4AFE23ACA82DBDA0076890D352C426DED725AE57D36253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery expiro spyware stealer trojan
- Expiro payload
  backdoor
- Family: Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Disables taskbar notifications via registry modification
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  defense_evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2