MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Expiro

Vendor detections: 14

Intelligence 14 IOCs YARA 4 File information Comments

SHA256 hash:	623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92
SHA3-384 hash:	138f3ad21c3019549a246f61251dc43ec6cef9e875e053d80ce64999566b8a98853a836d2856cfd509341c2828eeba86
SHA1 hash:	763a08271b04a0fab9cde37d0630b3c8a0ef55c0
MD5 hash:	68424a69972214a71cd0b03b5fb94004
humanhash:	twelve-harry-magazine-queen
File name:	623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92
Download:	download sample
Signature	Expiro Create hunting rule
File size:	1'347'584 bytes
First seen:	2024-07-18 12:21:56 UTC
Last seen:	2024-07-24 15:04:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	193b654ecb38f71ffa2fa47fac4c2bf7 (1 x Expiro)
ssdeep	12288:TtOw6BasMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:B6BSSkQ/7Gb8NLEbeZ
Threatray	1 similar samples on MalwareBazaar
TLSH	T1B655F01372D08463D0633A31386FCB7F0669BD6F5B30B937279C7F4A99B4580A966632
TrID	46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	f08eb26969b28ef0 (6 x Azov, 1 x Expiro)
Reporter	JAMESWT_WT
Tags:	exe Expiro przvgke-biz

Intelligence

File Origin

# of uploads :

# of downloads :

358

Origin country :

Vendor Threat Intelligence

Detection(s):

Win.Trojan.Filerepmalware-10008115-0

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=669908ef6ac935d7e8db8ddc

Tags:

Generic Network Stealth Infector

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %AppData% directory

Modifying an executable file

Creating a window

Launching a service

Searching for synchronization primitives

Creating a file in the Windows subdirectories

Connection attempt to an infection source

Modifying a system executable file

Launching a process

Searching for the window

Loading a system driver

Modifying a system file

Using the Windows Management Instrumentation requests

Enabling autorun for a service

Query of malicious DNS domain

Enabling autorun with the shell\open\command registry branches

Infecting executable files

Sending an HTTP POST request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

keylogger microsoft_visual_cc

Link:

https://www.filescan.io/uploads/669908efa537d9330bdf5736/reports/fe8944e7-84ec-4c21-8aad-9e0dfa550309/overview

Verdict:

Malicious

Labled as:

Expiro.Generic

Link:

https://www.hybrid-analysis.com/sample/623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Expiro

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d5de2e79-66e2-4d81-9104-aae7f8c1d6b2

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1475909

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to behave differently if execute on a Russian/Kazak computer

Creates files inside the volume driver (system volume information)

Drops executable to a common third party application directory

Found direct / indirect Syscall (likely to bypass EDR)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries random domain names (often used to prevent blacklisting and sinkholes)

Snort IDS alert for network traffic

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92/

Threat name:

Win32.Virus.Expiro

Status:

Malicious

First seen:

2024-07-18 02:54:30 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

32 of 38 (84.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mi52g5a2n6piplxrkv6sg46nwbrsw42xxkaqwi4ig34z6cpybwja._file

Verdict:

malicious

Expiro

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/240718-pjwxzaxhrm/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f8acc799-5827-4642-888f-0f9d776e1c02

Unpacked files

SH256 hash:

e1c14d0c4b2c281d0c7b8eeda6e00c9df4dc1911f666f4a08a8b3fbab20c3c06

MD5 hash:

07aff2dfd03c866e7128f6b6bdb902f3

SHA1 hash:

68c716c1f1a35396f5ecf3ab3a8011645201df99

Link:

https://www.unpac.me/results/228c63e7-a8ff-4c33-87ba-5aa3f8d5844b/

SH256 hash:

f0d666ddf01d365ebf1e7fbfbf100a7d5d07c0dfad7308b79ee23223672994ea

MD5 hash:

b9581fdf42c20550e202356beedb0d28

SHA1 hash:

8779b5578dd741369aae6d0997635ca1196a6753

Link:

https://www.unpac.me/results/228c63e7-a8ff-4c33-87ba-5aa3f8d5844b/

SH256 hash:

623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92

MD5 hash:

68424a69972214a71cd0b03b5fb94004

SHA1 hash:

763a08271b04a0fab9cde37d0630b3c8a0ef55c0

Link:

https://www.unpac.me/results/228c63e7-a8ff-4c33-87ba-5aa3f8d5844b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Expiro

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/623ba3741a6f9e87aef1557d2373cdb0632b7357ba810b238836f99f09f80d92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::OpenProcess KERNEL32.dll::VirtualAllocEx KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::EmptyClipboard USER32.dll::OpenClipboard USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample