MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Expiro


Vendor detections: 15


Intelligence 15 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
SHA3-384 hash: 19441672c893ac6afd9c59db533dde08e462b15740d84ae81ca73fa1edc12fc5c3cc20e544fa4aac68be3d84bea4cdec
SHA1 hash: 97d834d250ffd325f605c057f2ee21d105b4d0fb
MD5 hash: eda285529089b538857233cd53dc075b
humanhash: venus-lake-robin-solar
File name:b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
Download: download sample
Signature Expiro
Create hunting rule
File size:1'780'736 bytes
First seen:2025-08-12 14:30:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:qtb20pOaCqT5TBWgNQ7aP+676Na0aQtpCny86a26ACsqjnhMgeiCl7G0nehbGZpv:Xvg5tQ7aP+674HCnc55GDmg27RnWGj
Threatray 2'705 similar samples on MalwareBazaar
TLSH T10785F12373DD8365C3B25273BA65B701AE7B7C250AA1F86B2FD4093DF920161521EA73
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter adrian__luca
Tags:exe Expiro

Intelligence

File Origin
# of uploads :
1
# of downloads :
26
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
Verdict:
Malicious activity
Analysis date:
2025-08-12 20:23:52 UTC
Tags:
m0yv
Link:
https://app.any.run/tasks/fdaf3cba-f78b-411d-892a-2030112147af

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20686/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b52fac633abe3908e50c5
Tags:
autoit expiro emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% directory
Modifying a system executable file
Creating a window
Launching a service
Launching a process
Searching for synchronization primitives
Creating a file in the system32 subdirectories
Creating a file in the %temp% directory
Loading a system driver
Connection attempt to an infection source
Modifying an executable file
Sending a custom TCP request
Modifying a system file
Creating a file in the Windows subdirectories
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun for a service
Query of malicious DNS domain
Infecting executable files
Verdict:
Malicious
Labled as:
Expiro.Generic
Link:
https://www.hybrid-analysis.com/sample/b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/147894ec-23f8-4242-ab56-77e6c269444f
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6/
Verdict:
Malicious
Threat:
Virus.Win32.Moiva
Link:
https://tip.neiki.dev/file/b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
Threat name:
Win32.Virus.Expiro
Create hunting rule
Status:
Malicious
First seen:
2025-07-26 03:37:43 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
31 of 36 (86.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w76ilqpgqiq2cde4ttemgiprulgorpuzcthvam5dqllggtn3bkta._file
Verdict:
malicious
Label(s):
expiro
Create hunting rule
Similar samples:
0064c892c106bad3b10ffa879aa3522cf344a0dbdd9e09de1e7f8f8ca99b92df
Expiro
0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418
Expiro
5ae86c1b231a95b8eaa105ca9214589dea3d22efd601cd2018f7a5e6c474ddca
Expiro
a77fe5da2091d1ca156b8d6713e2af40cc0d66449011c59b699cbc652a07ee34
Expiro
b336830d627101633db934f8d48606639c70d133a5985026bc250c035e887faf
Expiro
error
Expiro
+ 2'695 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/250812-tkf1csep3s/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
AutoIT Executable
Drops file in System32 directory
Executes dropped EXE
Reads user/profile data of web browsers
Verdict:
Malicious
Tags:
trojan expiro Expiro
YARA:
Windows_Virus_Expiro_84e99ff0
Link:
https://app.threat.zone/submission/21041155-5c6c-4fd0-b807-afdcd4fe3713
Unpacked files
SH256 hash:
b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
MD5 hash:
eda285529089b538857233cd53dc075b
SHA1 hash:
97d834d250ffd325f605c057f2ee21d105b4d0fb
Link:
https://www.unpac.me/results/051d34d8-b24b-45a8-a20f-67124fbec090/
SH256 hash:
56f71a8da2d26dde4c2ca15d1b5ff22a39de7f09f2cfc84c6ebad75f26c31577
MD5 hash:
3388116e83535055a06384e1f9d97f96
SHA1 hash:
f749a3329d5628d35665dcaf848aea50025de554
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/051d34d8-b24b-45a8-a20f-67124fbec090/
Parent samples :
38e65102a6d8af117d96ba3159ab096d2b95ea8615408667997ce1375c00f35e
5bf3c820c4ed7b2b2e38dec099a4b76273a4e82472ced8f9cad59ba37b02dcb1
61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3
adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
adf664c4bba9af7873a7aa41ee0f2264e2757f14d8ac6619194572b58c1e7e68
2fbeb147acc6a400fdf52595966a38c61f6b323536d9a244de11067c9da57610
f0a905542b77b1e9d101dff1115070bffd1871f4c2ada0f3a95ee21081e8c671
3d4b7da0e29cdd7948064dd1a63fe86401240716d54ab1ef4d6e234e0b66807e
4857ee7f02efc4f90333790708097f4ad955beaaf41cdfe6ba11a5385a1ba8d5
2412e0910cc1deae89794bb142f6a0ec6089761fcace1f51f968b8f62bb19c32
34c4a7d2e16716cc0a9f9518718dd8efd2d36f97d2ee93721b9c2b40f4a164ce
cad6df3e9a9ac2d74b5c5276ab7192b8b876cde19259b8a567c80e44362e898f
f10a61792867b7b2d84daa851f8d24169a96cb70b55e09931a7ed2c01853634f
c3c235915752db934ca00b7c30cbcb2b5d83c2a52400ac29ccc1bd66573c534f
ad248905f0468cc57eacd8d3dadd474cd31a8b778c2a0eb952f48bdc525a1ee8
825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2
9ffbfc64827a32593bdcff306f45afaaa69cda089c1b3ed28a8889d17dbf33d0
76692d50ea8233a8ca9d3f9a89890d9a2149f0ff9859476920ed3ffc84c63f64
4caa9777053748e8ee0190b4056f93e1cc6506c212c06c67622c0cf6f476665b
a0cdffded083ccadb44b6b7841cd16580cf4638a573d2684134181dca7462d3a
6a11ab33aa16d2d8ba08cb3c6edb5e0613c1d459287261ecd907f9359068cbc8
b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
affbb0db85505a477fad583411e0361f0502ef4d9c46059da31ca85eb0e0b5d6
261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141
8c787bab18fce858e66ef04e233ec2e318503e250300628707bc833f23a79194
aa0227c6018d030ef8e31630cd92673ac3d30f7826a49059b4abfc26c77fd486
18af0ba21e4c33129d6a6774af76b2f09cf8ddf9e05fc9917c7b25a6e978e034
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b7fc85c1e682/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Generic_Threat_ebf62328
Create hunting rule
Author:Elastic Security
Rule name:Windows_Virus_Expiro_84e99ff0
Create hunting rule
Author:Elastic Security
Rule name:win_m0yv_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.m0yv.
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20686/

Comments