MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64cf222f88414af0d6e11baafe918c693c73966012f93aef4702bcb37606def2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Expiro

Vendor detections: 10

Intelligence 10 IOCs YARA 16 File information Comments

SHA256 hash:	64cf222f88414af0d6e11baafe918c693c73966012f93aef4702bcb37606def2
SHA3-384 hash:	00bbb741c1a4656222e1b1e0efe5490a6f1678ac23403aa23030ee50e69ce75966cfc4c269b4573d8da5250c0b32c740
SHA1 hash:	9666df91d416308ecc1444d2091c41ca1fe22d88
MD5 hash:	4432797dbdf48965063644fb114701fd
humanhash:	stream-aspen-may-black
File name:	New order 52825-01BB Bangladesh.7z
Download:	download sample
Signature	Expiro Create hunting rule
File size:	1'207'810 bytes
First seen:	2025-06-19 07:41:29 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	24576:xs+ExY1UYaeoEIkxCbL//lOTg3dy2Xl3nOi5eOd07x+FJGO2OLTh:kxQUYiGCX/SgNZVXv5Y7x+FB2Ut
TLSH	T12D4533F9DD0FA5CA99B1277909FAF6B14C0637925F212CD0E1AAECF4DA51D30222D097
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	cocaman
Tags:	7z Expiro

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	New order 52825-01BB Bangladesh.exe
File size:	1'721'856 bytes
SHA256 hash:	a77fe5da2091d1ca156b8d6713e2af40cc0d66449011c59b699cbc652a07ee34
MD5 hash:	c9ce49c6d081bb51fff025c2119db2f8
MIME type:	application/x-dosexec
Signature	Expiro

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.Expiro-1.UNOFFICIAL

SecuriteInfo.com.Win32.Expiro-2.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6853e984d1262bb4773b288d

Tags:

autorun autoit emotet

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/64cf222f88414af0d6e11baafe918c693c73966012f93aef4702bcb37606def2/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint keylogger masquerade microsoft_visual_cc packed packed packer_detected phishing

Link:

https://www.filescan.io/uploads/6853bf433faf8fcd7d35f9ac/reports/1f182562-eb40-46bb-a591-42143f48c7db/overview

Verdict:

Suspicious

Labled as:

Mal/Drod7zip

Link:

https://www.hybrid-analysis.com/sample/64cf222f88414af0d6e11baafe918c693c73966012f93aef4702bcb37606def2

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250619-kj3nasdq7v/

Behaviour

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

AutoIT Executable

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Expiro

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/64cf222f88414af0d6e11baafe918c693c73966012f93aef4702bcb37606def2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Windows_Generic_Threat_ebf62328 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Virus_Expiro_84e99ff0 Create hunting rule
Author:	Elastic Security

Rule name:	win_m0yv_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.m0yv.

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Expiro

7z 64cf222f88414af0d6e11baafe918c693c73966012f93aef4702bcb37606def2

(this sample)

AgentTesla

exe a77fe5da2091d1ca156b8d6713e2af40cc0d66449011c59b699cbc652a07ee34

Delivery method

Distributed via e-mail attachment

Dropping

SHA256 a77fe5da2091d1ca156b8d6713e2af40cc0d66449011c59b699cbc652a07ee34

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample