expiro | 3c37ab421d4acb44438a6198f70a2c2ecd19abf61b4d94ceac90d97519a74377

General

Target
2026-08-16_4d44a08ac9bb2cd9e1fe2e478a61e82f_amadey_elex_luca-stealer_njrat_smoke-loader
Size 2.0MB
Sample260816-m58sjswwht
SHA256 3c37ab421d4acb44438a6198f70a2c2ecd19abf61b4d94ceac90d97519a74377
MD5 4d44a08ac9bb2cd9e1fe2e478a61e82f
SHA1 9f234a6fc6584fa2fbc545d0a20c674b39b22f35
SHA512 95c28fa7e419c1ea2abeeefdbe940dc2bc04fd0f3a303afbd43dcacf3171e83e385d61e79c6042d909b2c8822c05817fcc9e1b02c90c51d98110fe3ebba00f7b
SSDEEP 24576:QGyWem1gXq5L9uSWidgpm6hbpOSRKQVn6R5zwUqMpcWuh4epMWFawTVTK:Q1Xq5L9uiibpJKQGcWqnLT
TLSH
T1C8A56C0DB7A1502CFDF305FA4AFE63ACA82CB9A0076894D352C416DED725AE57C32653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-16_4d44a08ac9bb2cd9e1fe2e478a61e82f_amadey_elex_luca-stealer_njrat_smoke-loader
- Size 2.0MB
- SHA256 3c37ab421d4acb44438a6198f70a2c2ecd19abf61b4d94ceac90d97519a74377
- MD5 4d44a08ac9bb2cd9e1fe2e478a61e82f
- SHA1 9f234a6fc6584fa2fbc545d0a20c674b39b22f35
- SHA512 95c28fa7e419c1ea2abeeefdbe940dc2bc04fd0f3a303afbd43dcacf3171e83e385d61e79c6042d909b2c8822c05817fcc9e1b02c90c51d98110fe3ebba00f7b
- SSDEEP 24576:QGyWem1gXq5L9uSWidgpm6hbpOSRKQVn6R5zwUqMpcWuh4epMWFawTVTK:Q1Xq5L9uiibpJKQGcWqnLT
- TLSH
  T1C8A56C0DB7A1502CFDF305FA4AFE63ACA82CB9A0076894D352C416DED725AE57C32653
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery expiro spyware stealer trojan
- Expiro payload
  backdoor
- Family: Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Disables taskbar notifications via registry modification
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  defense_evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2