MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Expiro

Vendor detections: 16

Intelligence 16 IOCs YARA 28 File information Comments

SHA256 hash:	0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418
SHA3-384 hash:	dc1a3d4dac1b52a4681b30f59a37f69f232dfca6fe2bef2848e2c94ebcbdf47ec222be6363f7e46a88b44248fd2bdf34
SHA1 hash:	b15a5a64b370dbcb382384c5b8b52aec4ecebe4f
MD5 hash:	e7a4a5457c57218a23ce511ffc3bdecd
humanhash:	social-kentucky-sierra-illinois
File name:	0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418
Download:	download sample
Signature	Expiro Create hunting rule
File size:	1'913'344 bytes
First seen:	2025-08-12 13:53:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	49152:Ydg5tQ7aKNa76gfrGA5yGZ452Dmg27RnWGj:Cg563Bg/sYD527BWG
Threatray	2'732 similar samples on MalwareBazaar
TLSH	T14E95F12363DD8361C7B25273BA66B701AEBB7C2506A1F56B2FD40C7CF960121461EA73
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	adrian__luca
Tags:	exe Expiro

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418

Verdict:

Malicious activity

Analysis date:

2025-08-12 14:39:05 UTC

Tags:

m0yv auto-startup

Link:

https://app.any.run/tasks/87224f57-b1fd-44cc-a3cf-ad7b0e8eac05

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DarkCloud

Link:

https://www.capesandbox.com/analysis/20414/

Detection(s):

SecuriteInfo.com.Win32.Expiro-1.UNOFFICIAL

SecuriteInfo.com.Win32.Expiro-2.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689b485dc633abe3908e4a19

Tags:

autorun autoit expiro emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %AppData% directory

Modifying a system executable file

Creating a window

Launching a service

Launching a process

Searching for synchronization primitives

Creating a file in the system32 subdirectories

Creating a file in the %temp% directory

Loading a system driver

Modifying an executable file

Modifying a system file

Creating a file

Creating a process from a recently created file

Creating a file in the Windows subdirectories

Sending a custom TCP request

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Creating a file in the %AppData% subdirectories

Reading critical registry keys

Enabling autorun for a service

Query of malicious DNS domain

Connection attempt to an infection source

Forced shutdown of a system process

Stealing user critical data

Infecting executable files

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Expiro.Generic

Link:

https://www.hybrid-analysis.com/sample/0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418

Malware family:

Expiro

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5ef1330e-8e4c-4198-84e0-fff22708ee12

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418/

Threat name:

Win32.Virus.Expiro

Status:

Malicious

First seen:

2025-07-18 01:28:53 UTC

AV detection:

23 of 24 (95.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=biov7sg2nwyuv7dgvr3exncerpvh4k2jbcealnxqcos3f5cogqma._file

Verdict:

malicious

Label(s):

expiro

Expiro

0ea2f7230b7cb4a06bc6810e647a96d445962148694b45d282d551402d8f52db

Expiro

5ae86c1b231a95b8eaa105ca9214589dea3d22efd601cd2018f7a5e6c474ddca

Expiro

903b549f2dc9a5951062f4c941af0eeb2eb7b27e31775877d1b93608c3961735

Expiro

9a759f2ef8ee16b697f30aab51fc726f9697b338e0aba56c063860146bbfc76b

Expiro

a77fe5da2091d1ca156b8d6713e2af40cc0d66449011c59b699cbc652a07ee34

Expiro

b336830d627101633db934f8d48606639c70d133a5985026bc250c035e887faf

Expiro

error

Expiro

+ 2'722 additional samples on MalwareBazaar

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud discovery spyware stealer

Link:

https://tria.ge/reports/250812-rfzkss11cw/

Behaviour

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

AutoIT Executable

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

DarkCloud

Darkcloud family

Verdict:

Malicious

Tags:

trojan expiro

YARA:

Windows_Virus_Expiro_84e99ff0

Link:

https://app.threat.zone/submission/3f537880-f66a-4026-91b3-268e106559f3

Unpacked files

SH256 hash:

0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418

MD5 hash:

e7a4a5457c57218a23ce511ffc3bdecd

SHA1 hash:

b15a5a64b370dbcb382384c5b8b52aec4ecebe4f

Link:

https://www.unpac.me/results/57975efd-083e-4a21-9050-e365521bcebc/

SH256 hash:

bc225b96ec12686a940cdde958109aa0ba2bde8bcdcfcc5b4477f2e625a23424

MD5 hash:

7ad44df2927ac30b5164e5b14db565b6

SHA1 hash:

0f9bbb5d4a358a43c10817b41b35547494cd5b80

Detections:

darkcloudstealer

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

INDICATOR_SUSPICIOUS_EXE_CC_Regex

MALWARE_Win_A310Logger

MALWARE_Win_DarkCloud

Link:

https://www.unpac.me/results/57975efd-083e-4a21-9050-e365521bcebc/

SH256 hash:

3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a

MD5 hash:

94d1531b52774dce52a89e33646d5b1d

SHA1 hash:

29bf887b025b97bd7a9e1e261852ba824234a625

Link:

https://www.unpac.me/results/57975efd-083e-4a21-9050-e365521bcebc/

Malware family:

DarkCloud

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0a1d5fc8da6d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Expiro

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_CC_Regex Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing credit card regular expressions

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MALWARE_Win_A310Logger Create hunting rule
Author:	ditekSHen
Description:	Detects A310Logger

Rule name:	MALWARE_Win_DarkCloud Create hunting rule
Author:	ditekSHen
Description:	Detects DarkCloud infostealer

Rule name:	ProtectSharewareV11eCompservCMS Create hunting rule
Author:	malware-lu

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Windows_Generic_Threat_ebf62328 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_DarkCloud_9905abce Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Virus_Expiro_84e99ff0 Create hunting rule
Author:	Elastic Security

Rule name:	win_m0yv_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.m0yv.

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20414/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample