expiro | 75293b66c7d0ea66b36704b8c98febdf7458861b9020baac549da11f70e740d3

General

Target
75293b66c7d0ea66b36704b8c98febdf7458861b9020baac549da11f70e740d3
Size 816KB
Sample260911-qf1bnaha44
SHA256 75293b66c7d0ea66b36704b8c98febdf7458861b9020baac549da11f70e740d3
MD5 cb64fbd5d2a4f675ee88565fbe891695
SHA1 59fa0490cd7d8bf6620272607bb02fe7a0c351cc
SHA512 7034f4e86050c433e50b05e6ac5e9d4fea8324cda1eb9a68fffcc5e31085e4f8681ceb691d24e666d0af6e39dd39c2f215c38457b1b51b451d2008da1f4ea870
SSDEEP 12288:8acGkW99LzFGykE7vgW7P7eaGik++5c65Mf12BzoiTnOGUv+8CElQSlnUhIQE:4DWnkE7vrXeX++m6WfAB8kHFSlnDQ
TLSH
T17B05CFE2B78C8DE3D60442B3585AAB7176316D536F1113A3B643F35EEEF22982163352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  75293b66c7d0ea66b36704b8c98febdf7458861b9020baac549da11f70e740d3
- Size 816KB
- SHA256 75293b66c7d0ea66b36704b8c98febdf7458861b9020baac549da11f70e740d3
- MD5 cb64fbd5d2a4f675ee88565fbe891695
- SHA1 59fa0490cd7d8bf6620272607bb02fe7a0c351cc
- SHA512 7034f4e86050c433e50b05e6ac5e9d4fea8324cda1eb9a68fffcc5e31085e4f8681ceb691d24e666d0af6e39dd39c2f215c38457b1b51b451d2008da1f4ea870
- SSDEEP 12288:8acGkW99LzFGykE7vgW7P7eaGik++5c65Mf12BzoiTnOGUv+8CElQSlnUhIQE:4DWnkE7vrXeX++m6WfAB8kHFSlnDQ
- TLSH
  T17B05CFE2B78C8DE3D60442B3585AAB7176316D536F1113A3B643F35EEEF22982163352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor credential_access defense_evasion discovery expiro persistence privilege_escalation spyware stealer trojan
- Expiro payload
  backdoor
- Family: Expiro, m0yv
  Expiro aka m0yv is a multi-functional backdoor written in C++.
  backdoor expiro
- Disables taskbar notifications via registry modification
  defense_evasion
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  defense_evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1