expiro | 3b8ca4974e77db7fae198b22d708304642600bb4b85a55d77a64191459c5b9d0

General

Target
2026-08-19_fe9bcc4b7433a10791ab7764b6cbe613_amadey_elex_luca-stealer_njrat_smoke-loader
Size 2.0MB
Sample260819-ph79lsar2y
SHA256 3b8ca4974e77db7fae198b22d708304642600bb4b85a55d77a64191459c5b9d0
MD5 fe9bcc4b7433a10791ab7764b6cbe613
SHA1 6b61da1c8cf11170170bb752577bbc828c914b1d
SHA512 d151556e117645644d8d7b40e39c08e02d7462ad35522803e8ded2744b99c14536566b86b7f53f0f595a4ca97c014efdc056a62f31d409b8a20c3e21b643ed25
SSDEEP 24576:QGyWem1gXq5L9uSWidgpm6hbpOSRKQVn6R5zwUqMpcWuh4epMWFvOTVTK:Q1Xq5L9uiibpJKQGcWqnYT
TLSH
T165A56C0DB7A1502CFDF305FA4AFE63ACA82CB9A0076894D352C416DED725AE57C32653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-19_fe9bcc4b7433a10791ab7764b6cbe613_amadey_elex_luca-stealer_njrat_smoke-loader
- Size 2.0MB
- SHA256 3b8ca4974e77db7fae198b22d708304642600bb4b85a55d77a64191459c5b9d0
- MD5 fe9bcc4b7433a10791ab7764b6cbe613
- SHA1 6b61da1c8cf11170170bb752577bbc828c914b1d
- SHA512 d151556e117645644d8d7b40e39c08e02d7462ad35522803e8ded2744b99c14536566b86b7f53f0f595a4ca97c014efdc056a62f31d409b8a20c3e21b643ed25
- SSDEEP 24576:QGyWem1gXq5L9uSWidgpm6hbpOSRKQVn6R5zwUqMpcWuh4epMWFvOTVTK:Q1Xq5L9uiibpJKQGcWqnYT
- TLSH
  T165A56C0DB7A1502CFDF305FA4AFE63ACA82CB9A0076894D352C416DED725AE57C32653
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery expiro spyware stealer trojan
- Expiro payload
  backdoor
- Family: Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Disables taskbar notifications via registry modification
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  defense_evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2