expiro | 44c4a107c427812112eb02f8a752cc2788f768a78953046ffa693e3a816a85e5

General

Target
2026-08-09_06fc49001eb45d8ee13ed1df6f286265_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
Size 722KB
Sample260809-scte2sgq5z
SHA256 44c4a107c427812112eb02f8a752cc2788f768a78953046ffa693e3a816a85e5
MD5 06fc49001eb45d8ee13ed1df6f286265
SHA1 4bd4e8354b8f8afeaf36c8ce4c1a77eadc016860
SHA512 1debcae0ad5443eb8d52de933fe8fd1f4846c37798bcdb84e5b251c967e5a1d66b4a5e3f6c6994d9b06e0120a85d25eb819b8e37754b5e3b5a47fc0ac6677380
SSDEEP 12288:LUYJ9biqYV8zkdy049jeCDy1Wj6ejzTOx1CmCTM:oYJ9bhYVK96Yy1vBx1CL
TLSH
T18AF47CD439844675DEB2A1778C6016BBF314AC1A6625FCEB11A065390EFDAC2D83F2F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_06fc49001eb45d8ee13ed1df6f286265_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat
- Size 722KB
- SHA256 44c4a107c427812112eb02f8a752cc2788f768a78953046ffa693e3a816a85e5
- MD5 06fc49001eb45d8ee13ed1df6f286265
- SHA1 4bd4e8354b8f8afeaf36c8ce4c1a77eadc016860
- SHA512 1debcae0ad5443eb8d52de933fe8fd1f4846c37798bcdb84e5b251c967e5a1d66b4a5e3f6c6994d9b06e0120a85d25eb819b8e37754b5e3b5a47fc0ac6677380
- SSDEEP 12288:LUYJ9biqYV8zkdy049jeCDy1Wj6ejzTOx1CmCTM:oYJ9bhYVK96Yy1vBx1CL
- TLSH
  T18AF47CD439844675DEB2A1778C6016BBF314AC1A6625FCEB11A065390EFDAC2D83F2F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery expiro spyware stealer trojan
- Expiro payload
  backdoor
- Family: Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Disables taskbar notifications via registry modification
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  defense_evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2