MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 131e2d751cc80f1381881cebc9ebf6df5ff3140a48afb831e26350b73575a3ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Expiro
Vendor detections: 14
| SHA256 hash: | 131e2d751cc80f1381881cebc9ebf6df5ff3140a48afb831e26350b73575a3ec |
|---|---|
| SHA3-384 hash: | b617e8b35086a3538d8b15af5644c6e025aa4f2638294d69e53ebbfd1f16e6c354e23c3dff6ea22a7bc2d586100f29e7 |
| SHA1 hash: | 282de7976f3cb0b45f0492100b92fb5c6033434d |
| MD5 hash: | 153592c7723535410aad6fa22517341c |
| humanhash: | nitrogen-william-tennis-jersey |
| File name: | 131e2d751cc80f1381881cebc9ebf6df5ff3140a48afb831e26350b73575a3ec.exe |
| Download: | download sample |
| Signature | Expiro |
| File size: | 1'482'752 bytes |
| First seen: | 2026-10-14 15:59:42 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'298 x AgentTesla, 20'717 x Formbook, 12'402 x SnakeKeylogger) |
| ssdeep | 24576:CUTKnKkGS/OAlpzwdGzWvuW0oi7dNdLI44mckWOaiyoWT63VB7EV:CrnKkGS/LHzivpDAamc3OoK |
| TLSH | T1C16523213469DB23CA615BF52961E17123F12DFE5C62E1019FC27CEF7E32B125602A6B |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | f0e4e2d1c4b8ccf0 (7 x Formbook, 3 x DarkCloud, 1 x AgentTesla) |
| Reporter |  ShadowOpCode |
| Tags: | exe Expiro RGBLoader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
82
Origin country :
ITVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Suspicious activity
Analysis date:
2026-10-14 17:59:33 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
96.5%
Tags:
virus cupi
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Creating a file
Creating synchronization primitives
Creating a file in the %AppData% directory
Modifying a system executable file
Launching a service
Searching for synchronization primitives
Loading a system driver
Connection attempt to an infection source
Creating a file in the system32 subdirectories
Modifying a system file
Modifying an executable file
Creating a file in the Windows subdirectories
Using the Windows Management Instrumentation requests
Forced shutdown of a system process
Enabling autorun for a service
Query of malicious DNS domain
Unauthorized injection to a system process
Infecting executable files
Sending an HTTP POST request to an infection source
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
entropy krypt obfuscated packed vbnet
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-11T23:50:00Z UTC
Last seen:
2026-10-16T13:01:00Z UTC
Hits:
~100
Verdict:
Unknown
Score:
99%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.33 Win 32 Exe x86
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Status:
Malicious
First seen:
2026-10-12 05:05:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
27 of 36 (75.00%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Enumerates connected drives
Executes dropped EXE
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
131e2d751cc80f1381881cebc9ebf6df5ff3140a48afb831e26350b73575a3ec
MD5 hash:
153592c7723535410aad6fa22517341c
SHA1 hash:
282de7976f3cb0b45f0492100b92fb5c6033434d
SH256 hash:
726c77667bba9d00f1bbab4458575886d7b9c2a25f03778f450eccd61c27077a
MD5 hash:
851cb490df07fd59ced729b98a3ef974
SHA1 hash:
294cd83cfd813bee16acd397fc027fbc8028cdda
SH256 hash:
031f5387e15cb20e2b022482531e9b863da1c0825c3e057a5197cf1fc75ff5c3
MD5 hash:
e962af4749fabdcda10df6da328f28ad
SHA1 hash:
f335dbd80b7dd1798cde7b4a433167c454d4c7dc
SH256 hash:
f72c54f86ac0c3b275da6f92e28dbb71ade1b45491272ae2fbf0688fe76194f3
MD5 hash:
b2760fb6afe2e06065c00f2c6b655842
SHA1 hash:
1c658592db8cfa9e1ec35c1d1090a256a52734f9
Detections:
triage_expiro_worm
SH256 hash:
0e8c482fd25d40111808059a77b0cbe98945ce6cc389ed105eed5bc09267725b
MD5 hash:
fd25803432ece2308bee12603956be7f
SHA1 hash:
20b550a827946717c2bb682b3418cd5758ec4751
SH256 hash:
db5a2a636d171b6d0f1399f0ad9ba954a95a584da78c4cff5324458b8c3024fd
MD5 hash:
bd74d5a0ee01a0d9dfb0d534c6984fc7
SHA1 hash:
2dc51017b99a58702469c504dfd2aac2b485a765
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Expiro
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DotNet_RGB_Embedded_AssemblyLoader_Hunt |
|---|---|
| Author: | ShadowOpCode |
| Description: | Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading |
| Rule name: | HUNT_NET_Loader_ImagePixel_To_AssemblyLoad |
|---|---|
| Author: | Anish Bogati |
| Description: | Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders. |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Runtime_Broker_Variant_1 |
|---|---|
| Author: | Sn0wFr0$t |
| Description: | Detecting malicious Runtime Broker |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait |
|---|---|
| Author: | Marjoriefort |
| Description: | Detects Derialock (pe, etat extrait) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.