MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Expiro

Vendor detections: 14

Intelligence 14 IOCs YARA 9 File information Comments

SHA256 hash:	7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594
SHA3-384 hash:	ca4cf15beae500f7e1980628fffbc029f2e89c3510d64b7a8345e7678989df6d370fee8743cdbc22315a7a67f3ec226d
SHA1 hash:	4fe17c4ef460e46818b23153d2cd4b40ccaec1a8
MD5 hash:	b0fe7e0fff1fe3214355f66689984cd3
humanhash:	september-white-mirror-december
File name:	7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594
Download:	download sample
Signature	Expiro Create hunting rule
File size:	1'847'296 bytes
First seen:	2025-08-12 14:02:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8ece721479be2f9e77aa110fc3be053b (10 x LummaStealer, 5 x DarkCloud, 3 x Stealc)
ssdeep	24576:mSIW1FztgpxQc8BTz2URj8ky9iXxQc8BTz2URj8ky9isVg9N9JMlDlfjRiVuVsW0:mSI4Sx6jdygx6jdyHgFIDRRAubt5M
TLSH	T186851216F29160F5E2674075CA114101EE36BD5B47A4EBDF43E88BA21EA7BD01F3DB22
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	adrian__luca
Tags:	exe Expiro

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594

Verdict:

Malicious activity

Analysis date:

2025-08-12 16:11:12 UTC

Tags:

m0yv darkcloud upx

Link:

https://app.any.run/tasks/5ba479ac-6042-4ccc-ad9e-47873f5d0acf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DarkCloud

Link:

https://www.capesandbox.com/analysis/20472/

Detection(s):

SecuriteInfo.com.Win32.Expiro-3.UNOFFICIAL

Win.Malware.Expiro-9951780-0

Win.Packed.Lazy-10056365-0

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689b4aaac633abe3908e4b27

Tags:

shellcode expiro virus blic

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %AppData% directory

Modifying a system executable file

Launching a service

Launching a process

Searching for synchronization primitives

Loading a system driver

Creating a window

Creating a file in the system32 subdirectories

Connection attempt to an infection source

Modifying an executable file

Creating a file

Sending a custom TCP request

Enabling autorun for a service

Query of malicious DNS domain

Infecting executable files

Unauthorized injection to a system process

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

darkcloud expiro fingerprint krypt microsoft_visual_cc packed virus

Link:

https://www.filescan.io/uploads/689b500d397fd3ce6fa634eb/reports/01957aae-ee4b-4f1e-995a-facb5d5c258d/overview

Verdict:

Malicious

Labled as:

Win64.Expiro.Generic

Link:

https://www.hybrid-analysis.com/sample/7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594

Malware family:

Expiro

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9afeb4e7-fc5e-4ee6-be6d-a8045dd5b9fc

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594/

Threat name:

Win64.Virus.Expiro

Status:

Malicious

First seen:

2025-07-21 16:59:15 UTC

File Type:

PE+ (Exe)

AV detection:

32 of 36 (88.89%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pioorpkuz3wii43d2wcbzribnv76qitnh7yhxybd6qxxgnwm2wka._file

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud discovery ransomware spyware stealer

Link:

https://tria.ge/reports/250812-rtp9aadn7w/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of SetThreadContext

Executes dropped EXE

Reads user/profile data of web browsers

DarkCloud

Darkcloud family

Verdict:

Malicious

Tags:

Win.Malware.Expiro-9951780-0 Expiro

YARA:

n/a

Link:

https://app.threat.zone/submission/6f96a3fc-eb57-4cbd-acf3-d840c9d6c4d9

Unpacked files

SH256 hash:

7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594

MD5 hash:

b0fe7e0fff1fe3214355f66689984cd3

SHA1 hash:

4fe17c4ef460e46818b23153d2cd4b40ccaec1a8

Link:

https://www.unpac.me/results/1a709949-fb7f-4a97-8246-a3d70fd3722e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Expiro

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Windows_Generic_Threat_ebf62328 Create hunting rule
Author:	Elastic Security

Rule name:	win_m0yv_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.m0yv.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20472/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high
CHECK_TRUST_INFO	Requires Elevated Execution (level:requireAdministrator)	high

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeBeginPeriod WINMM.dll::timeEndPeriod WINMM.dll::timeGetDevCaps WINMM.dll::timeGetTime
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken KERNEL32.dll::VirtualAllocEx KERNEL32.dll::WriteProcessMemory KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess ntdll.dll::NtQuerySystemInformation KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileMappingW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_SOCK_API	Uses Network to send and receive data	WS2_32.dll::freeaddrinfo WS2_32.dll::getaddrinfo WS2_32.dll::InetNtopW WS2_32.dll::WSACloseEvent WS2_32.dll::WSACreateEvent WS2_32.dll::WSAEnumNetworkEvents
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::OpenSCManagerW ADVAPI32.dll::OpenServiceW ADVAPI32.dll::QueryServiceStatus ADVAPI32.dll::StartServiceW
WIN_USER_API	Performs GUI Actions	USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample