Virus.Expiro.MA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,171 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 417 |
| First Seen: | October 1, 2022 |
| Last Seen: | April 9, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Virus.Expiro.MA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
ce25e6d033c21d2a40d3843bed18709b
SHA1:
9438766a932f1227671d05898166725cfb9031a1
SHA256:
BB9E60E1F3700111CCAB97AA3644635EB8C41F2B604153DACBB89F87E8632C60
File Size:
1.31 MB, 1306624 bytes
|
|
MD5:
aaea2458776919f7e4dbc350616eb175
SHA1:
541bc6aa1ccb2c6afaee43fd643fa60b10dc14b2
SHA256:
C0EB54989B7A06475D248AEB7ACFB25C01188B3EDFE5A0AA241EF428A802BBA4
File Size:
1.36 MB, 1359872 bytes
|
|
MD5:
15d6914c2dce24b3c73c8189a4491aa6
SHA1:
fc28035b7fdb9bced0e5c4c93cebca6ddf1dc019
SHA256:
AAA26E32D088362BE59B91244AEAFEEFB34ABBA31C7D43D98697E38681E81CBD
File Size:
1.40 MB, 1396736 bytes
|
|
MD5:
8d0bdcfefee5e052191a67febe8c9398
SHA1:
d090a052544835e9d7db58547aaa24b2c87dada2
SHA256:
2AD3F90A0E52378CBC8ECFC1EC085319C3AC8357E8A13DEFDC9DC4EC4F1DA26F
File Size:
1.78 MB, 1775616 bytes
|
|
MD5:
07223f2be0e634823d5bc4b83fa3befe
SHA1:
3f257b56d56acb0a07f01d96e446e6556803cf5a
SHA256:
3A31C320683EBFE8AB2DE7B36947B6F80A192060C61147598A810837851127E2
File Size:
602.11 KB, 602112 bytes
|
Show More
|
MD5:
063720e625547b2c67fecabc0f93e61e
SHA1:
bc878679713e7bb0fea5eed53d1df14a714eaacd
SHA256:
2FD6E3E23575EDA55C38D0FC31198A350556139ED57C1741440B928DAE7F7ACD
File Size:
1.34 MB, 1339392 bytes
|
|
MD5:
af782f097bc086be385dbcc0d508013a
SHA1:
69f30b4a83184b09a78bc352c18b22fa37c06e72
SHA256:
C933143F660DD1C0AEA88820818AFEFBC0F86287F119E257C86D1861F7211E07
File Size:
1.48 MB, 1482752 bytes
|
|
MD5:
3c39d1552694f0c188d4b7890e39c74a
SHA1:
26375cb4482a908777dd796b1a3f9b0c298ed66c
SHA256:
482BAA14DE9BF6F3A8E2973B7A1B75E51877270904FA4C0F548EF11478FA4BED
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
765f0136e9c24e3f90e2575ae996e2ab
SHA1:
a77b6e626e2ef540cdbe8836fb84084b6db6114d
SHA256:
BFE7C6731A0F150FCC014C21C73038768E9545507DB6D904A186287ECB149D67
File Size:
602.11 KB, 602112 bytes
|
|
MD5:
e6a00df78a00019c828628e9851dc372
SHA1:
12cc1692f5867c85cb7ea4439e72f11c5cbd464e
SHA256:
36128966232E1E2C90A9E913134116E645840F46131AA1C2A1172810806ED7FB
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
661fbfb4b7f122a82e842e66d7ca2070
SHA1:
9d26b1703d188c27a4f19da9e93e8d8ed2b619e6
SHA256:
3BCFAB27EA1799FD1D6C063BC5522BE338623AB8B78EE40122995FFDBC4F2C90
File Size:
1.26 MB, 1257472 bytes
|
|
MD5:
c22a6e27e8a73d987cd956a3afc2f24c
SHA1:
438259cec5cf4682caece8e676b8c29996d408a2
SHA256:
C32FB47AE486A9ED88883A570E7D271CD8C9D0431667B3DE882C68BAC8A1CE35
File Size:
1.44 MB, 1437696 bytes
|
|
MD5:
b02c53215d6ebc39f6ce6e2f89225c38
SHA1:
a4a8bc4a2a65b132ae6d90206a1a6e1baa99da20
SHA256:
B9F30DF9F823D5A8601EF1E90FEB418838A3E176816C794FF4C3DFAE1DDE828C
File Size:
602.11 KB, 602112 bytes
|
|
MD5:
cfc5649d9086f496b9d952cb98f7ac7b
SHA1:
f3b538d3a675faa005ae2180447f5fef03dfbcd2
SHA256:
05532618038E773ECF9AFB4742D86E72EE8BDCD42A96F98B8248784901411F1F
File Size:
1.52 MB, 1520128 bytes
|
|
MD5:
4073bdab10bcb0399a828f5140715573
SHA1:
510fe3a807f77c7d8d684b556999d7613403a76e
SHA256:
1BB38CF2F52AE5690897D741DCFAF79DAAA2A01A76676989F7053719FB55EBFE
File Size:
1.59 MB, 1594368 bytes
|
|
MD5:
9e424a85325748c330b506aad372c985
SHA1:
e63da96e361e2f744b4bddd6572869fffed0d505
SHA256:
85B15EC62CE200A549881F820D9ABC7F9E203EA3381680C96ABCC2706E3F241F
File Size:
602.11 KB, 602112 bytes
|
|
MD5:
762a8a20426179b6331ee81c9c16d37d
SHA1:
c37370a59b9d67ac401d66369de1c0dd3e4ef863
SHA256:
E05D6189F52AD19B3947C8DD18B01B4EA00A7889B4FAFC57D8D4D9C9852132BA
File Size:
1.58 MB, 1579520 bytes
|
|
MD5:
ef07c3fc668d8e9a4444b29b32bc46bb
SHA1:
7abbfde6ea8db6a2702c3910dc46ba63b8046b83
SHA256:
722818C3BF742315B157E18DFFB3723E8C8E10AED0D54B5E310B7719D4C18E4C
File Size:
1.44 MB, 1437696 bytes
|
|
MD5:
6b5025301d1b9271ff6c29752b3a7406
SHA1:
b17f1343ba827dbd8a1ac5f1cce9f2d35be396e0
SHA256:
5777FB17259DA1529A615612E365F18CFBCAF2F1A8F4E9D9C85F84F05D380BBB
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
3cbd0960871dc09bd75c6143d2e84f4c
SHA1:
6e9184a7c7dada9b7573959e1199f03640c4cf99
SHA256:
2B2E58016C267B249978DDCE583AD949D4D0F1A4F63CBC65CED93249C5258502
File Size:
602.62 KB, 602624 bytes
|
|
MD5:
25d3d23d6fdfa1b107ad95fa06194c59
SHA1:
4f6c0a5a60251b8ba017e4291d799d9cc416ca7f
SHA256:
2B25353F38052B0E33CFD22D0A24F17BABE3A05EBDAF6FCF525EA5CD24075AD9
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
033ce8950a511e76acc6e8a52a2e9792
SHA1:
55e53f2ac0badb29ee6edf3d69fd4b9f3bc9cc1a
SHA256:
D7F9CB01D3BFBEC6D7A62AD63B72C522887B9014D42747CEA9A99DD7A78BD676
File Size:
1.36 MB, 1360384 bytes
|
|
MD5:
0ffdb892302135e0baaf44d26c4bd689
SHA1:
de03c84edc33f765125f9952626871e730167fd0
SHA256:
4F22A8070E3D29B3FE5FCEB4C5C515728507247DFAD33B20977D4C9BC94C354E
File Size:
5.64 MB, 5641728 bytes
|
|
MD5:
bf9c71ee870d2067c6c9b6db634cbec6
SHA1:
fdb63893e7c9016a5c1093732609fd70cf50ae3d
SHA256:
956B0351BB0FB5ECA0917FC2FD3A78A28E54F6713A45E3DE1367A6E9CCC4C2F5
File Size:
1.31 MB, 1306624 bytes
|
|
MD5:
cb7e400e815f5521ad51c7b516ab71f7
SHA1:
6d52aa99ec4191b68166258d78dce6476c282e8f
SHA256:
8980B41AF084FE854DAF3260AEF967849A293A37792FA2C3E33F25E5387B08A6
File Size:
1.31 MB, 1306624 bytes
|
|
MD5:
cb25c07fef84e0fd4d7feb1de90875de
SHA1:
03caedab9dd1dd2f62ea61887b10dbc3435faf0c
SHA256:
B0DE00D0E92E1449AA25421047D909C71728953103D6A00B3EAF0C3A3761E2A8
File Size:
1.49 MB, 1486848 bytes
|
|
MD5:
7a56eb1df1cc0fb01cfa0aa99a375724
SHA1:
594d2e24052fd8c17cffbd5ebfd9707bf3bad9e5
SHA256:
ABEE8003AEC713D998A45D9DA9D58AA53195F76A6E54ECC2888753250B30A5BA
File Size:
1.44 MB, 1438208 bytes
|
|
MD5:
185390d5c95dbeb965b1fd705ddc0b33
SHA1:
7cf6480887bc4c613d6d59472028516e698ffc54
SHA256:
449EFC19468D5EF4EAA468920FD62FAABCF50A624AD8560715F62783B1D56AE2
File Size:
624.64 KB, 624640 bytes
|
|
MD5:
2bd73150bb3b6f08468d4c630b70e755
SHA1:
0976bddf4686b94eadd783afb781414a121ce1aa
SHA256:
BFE08A67F357B648DFB7F09D654BC951D1C21DB58C1AC0AFAE21019390ED5A42
File Size:
1.31 MB, 1306624 bytes
|
|
MD5:
66c600faba744e32c6d154e80a15015b
SHA1:
a03715c2b0c1bd21068adbb005dc5a426f0919d0
SHA256:
4279BD892898AF94486276EAF0862D9605058C4C1F48EC180FCE6E06BD928195
File Size:
1.31 MB, 1306624 bytes
|
|
MD5:
7d6deebf5cb7176bdea8f8d33ad13384
SHA1:
0862a7c06892fcc25f4ac8809e900994e497392d
SHA256:
9FE25ACA3A7130E1B847A4D3897699FF032CAB28BD4DED57B8A113A52E691867
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
5bf0b2452f31dfe85037fd8f7ca6a667
SHA1:
7b610a77f067884f2086740c56674819d63dbae9
SHA256:
98E62DB76756D50007C224A3229EF24BFF47E59B1847D068B41F52129B750DF3
File Size:
1.66 MB, 1664512 bytes
|
|
MD5:
e29b2dcd0f26ee7f2948a6e7b4e41fb1
SHA1:
d9f1f6ee4e6914259d9bdb9e12c0e256c411bdd3
SHA256:
F5D336B9C6476C87E26BB468884276214A45A4380B5E6D7B5461084071188A53
File Size:
2.45 MB, 2447872 bytes
|
|
MD5:
184229a6467c7aada2807f92cbfeccf7
SHA1:
4e6f676e9e9f26913f5d6a36f15c39750d020e92
SHA256:
3BD81C459D9BCCBAF1F4D6C6024A8F9D07EB5A322D91F854522EDE5388B1659A
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
c61937148326f6dd8ece9d3d0cdb0408
SHA1:
a7ba49818bdeb73130ebd85486ac2714756586d9
SHA256:
F1302ACCF96DA0D56E6E29F061EB911FA20748FBBDA00D0FDC9C95D9D481BD3B
File Size:
1.26 MB, 1257472 bytes
|
|
MD5:
1240834438a387b3cd21bd6aa60830b7
SHA1:
d1c374dd51475c009f41a0bd2894b53f32c4ab08
SHA256:
D539D537E74E92D226ACF69EAFA97A08D2930843B4361BB14870A3ECD4822544
File Size:
625.15 KB, 625152 bytes
|
|
MD5:
c4843d7b05f5643f804ea487b822ea7a
SHA1:
5d9f406254d8bbba9651087fc4012b33cca95601
SHA256:
6DCBFCA445F7A85B38E37CB26EEC0827F0F1DCCDB67D4C3774F9349476B873B0
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
e80992d49dff414d8eacda575f5ba4b2
SHA1:
66991d31205d06a5cc4bb350980428062316bdb0
SHA256:
DC6A80CC86610ADC0EC08E5FB6F435D60107D995FF07638DDDE38B39561B1367
File Size:
624.13 KB, 624128 bytes
|
|
MD5:
d77c2ed7d4b75c6ae535602add2da629
SHA1:
74e830159a057f2a6aa23a08f645a04582c79d1b
SHA256:
F057362CA7E812373BB91120BEA066AC4DE341B4F7CBAF41EE345E3950E43EE2
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
e97f2d5691aafddb96f323b6f4228745
SHA1:
7e777fade152c17cf6b8e051256ed78a9ed947b2
SHA256:
55620DCC250F39FD43F302ED269D7538D964E71D60650FB65A2322B2DEA9C7E9
File Size:
1.44 MB, 1437696 bytes
|
|
MD5:
004794f6d40d34f3566926dcb6c5c15d
SHA1:
fbebe295cad26db7d9856316e09430a49628a0dd
SHA256:
9A9DB36518D102BC28F1AFFAE124813D4F7BC6F94F580AB2DF2B24554EEBF94B
File Size:
602.11 KB, 602112 bytes
|
|
MD5:
895693dbf03fa1a258e22b205ab20dea
SHA1:
1bba994047d5f4bad80f2099c0b023f28c69b4a6
SHA256:
9C4F9C04F311A1B4A9151DCCF64A32CDBAE90A5E9E3F7E6B4AF7BF93B0EAC875
File Size:
1.31 MB, 1306624 bytes
|
|
MD5:
4e0d561b77c688351f7d82522f501996
SHA1:
bd7273b1a2e8f328d239b97abf80d84b46d025b8
SHA256:
7BB6776355186C571FDCB6139DAE76CC86DC8AC73EA5B9417D99F0A3C293D671
File Size:
1.42 MB, 1423360 bytes
|
|
MD5:
964e9d69a3effd37c07c620697d2f472
SHA1:
43128f06beeef8eb21a5cf8390eeaf90b8837b06
SHA256:
BC9DE180F3AE65F2D06845B20F778E7F7C9F6F932462466CC0496FA49287F291
File Size:
624.64 KB, 624640 bytes
|
|
MD5:
0749ed586183e262f3829fe458813702
SHA1:
182d79f9a3acd5ce6dc47b4f0601573872953076
SHA256:
216AA25B045C2895DDE578EC68EF3C4B526838950E91649BAC5F48065C8AA04F
File Size:
1.25 MB, 1249280 bytes
|
|
MD5:
e2c1a2bb9c95ba50400560368c37c43d
SHA1:
47bd8fda4de56fca16b56fd00f41aaccc059eed6
SHA256:
D6BBE510B38422E8BD6B2FFE350E0502DFD9DA3BBB2EACC023973BADCEED8B04
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
0f9adbed94617e52d0593b6e540502b5
SHA1:
e468001b039c102bd8ff854dc03ff7dea5862950
SHA256:
EDFC8C66FF4B0E41DD2877F378DB393D3609789EFF24E80401CED342B277F816
File Size:
1.30 MB, 1302528 bytes
|
|
MD5:
a760b7e26c77e7a9aad6e06b0acb8690
SHA1:
bff5430462b71ecf880d69411d373e6e93e72cdd
SHA256:
4FAA4E3D4DF9DA8F9A1318449B0D0B37888D3BA05107BF1BD8D0B2763B37808B
File Size:
1.44 MB, 1437696 bytes
|
|
MD5:
c7d26c393031e37f6251a47636cfca32
SHA1:
50fd474b1d31dc5cddbc520090e30e7220cc433e
SHA256:
160A6F73B0388470670B750CD5F8AF1608CF068953C80D1359BDDD9CD83AD3CD
File Size:
693.38 KB, 693376 bytes
|
|
MD5:
143b62b94715dc97af4b740aa7b15fb0
SHA1:
b471bcc2042274f009cb3b77d65f479c60879400
SHA256:
8BAACCEEBE32424A30B248B822319D0F45C84943BB29134C206A99A36BE1680D
File Size:
625.15 KB, 625152 bytes
|
|
MD5:
1ba2e30eaad9defba60140c5b32bd478
SHA1:
134917ed5d7945d6c28eabd6e6d181abd31440b5
SHA256:
ECDBC5F7CEDC84A314DAA689DAC6FC5368D7B7032A21CDE0A18F21FF031D9469
File Size:
6.44 MB, 6438912 bytes
|
|
MD5:
d38b922c028227b28bf0256cdfa1b714
SHA1:
7730053a14a99c6a529bc77dd2c02a2f35b0ea7c
SHA256:
0DFED2475389B3C6B31E159EAB0B6983E2657D9DC9807DB6F4D54B19A913C400
File Size:
1.31 MB, 1306624 bytes
|
|
MD5:
32a3f7e8156135a8325f440953d4d24c
SHA1:
9944abe4712029c9ee1d00e22733b4fc07af8921
SHA256:
C8B98325018D4DCB5A2F8D14A4F4ED349BAEFF4E39A5F32A2BFD0203830BBF8B
File Size:
1.31 MB, 1306624 bytes
|
|
MD5:
322e18b560692922b6e38aa0c0aaca69
SHA1:
aa61dd59c6da308ec31303f2691fb08f4a08b0d3
SHA256:
17B8270ACA2B33571A0969388E8DF9ADB70D7CE45650E370748FC92E774A12B2
File Size:
1.26 MB, 1257472 bytes
|
|
MD5:
f8c29fb9917ebcd83b2bfca944170d3f
SHA1:
5abd9cb34ce9accdc137a4cc220c6b804dd866d7
SHA256:
31E59ECC9FDAFFA85426E1EF1B0C0BFABCF8B1C4D07190D81C6160C8A48007D3
File Size:
756.74 KB, 756736 bytes
|
|
MD5:
89b503372a0f522ac07a4b1550027725
SHA1:
eec234e811d6b6bc2eec9c259111577fdbd643e1
SHA256:
7B83BEAA5A38FF7B05AB019DED71932CB247F56858DD3B7A877E125DA79935D7
File Size:
1.44 MB, 1437696 bytes
|
|
MD5:
7925c8c8bdd0582546cfa8d095069319
SHA1:
2b3db1c5331776b2fe552801e33da0ec623744ca
SHA256:
4EFA10DCB0E2D2720A729206292302DF992796F67B03523A8A91E7EF72BFDF30
File Size:
602.11 KB, 602112 bytes
|
|
MD5:
475c1f02382ec36340cc194b94d257b7
SHA1:
54d66c00fbdfa591f10dd3afad7efdb086544aa7
SHA256:
EBEA0263F7E05BCA78708F77B66AB4DC39DFF3946BBDE8FDE36AEEDAF05CCAEA
File Size:
6.59 MB, 6590464 bytes
|
|
MD5:
03d2369ae99a1580dee798b38ebb558e
SHA1:
d88fb9625a410d18477d5aac938ede18b7d9f6fd
SHA256:
B45BD081F5DE99242580E119CE9EF93CC583C2C73A44FCA6EA324C599EEBB01E
File Size:
1.72 MB, 1717248 bytes
|
|
MD5:
9d62bec8f05096eefe40d10dade1dc09
SHA1:
299cc651cf92668d9e8a4945b1e51ad79f9af2fb
SHA256:
6C088FB203CF2F543F336C820622E64BD390105B9597D893AFD0CEC2E5D5CF95
File Size:
1.24 MB, 1236992 bytes
|
|
MD5:
36a4cf731b0683297dad116424c579a6
SHA1:
d9af5ae1f7eaec0e2df5dcc416ad527952e30870
SHA256:
569934759B67243AD30E5D14F1B612EF96A9AE47DD05164FF962E5FDC7FD6B4D
File Size:
862.72 KB, 862720 bytes
|
|
MD5:
27a28b671b933cc52f17e1d1fe87432d
SHA1:
3b90dd1478ffdccd6814b05fd5dfba20a20e05b2
SHA256:
60EB45FB9F43518335D9F34CAFE0C11C1A86A7C29C91FB9B9553DCDA14AEED98
File Size:
1.58 MB, 1581056 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
|
| Legal Trademarks1 | Microsoft® is a registered trademark of Microsoft Corporation. |
| Legal Trademarks2 | Windows® is a registered trademark of Microsoft Corporation. |
| Original Filename |
Show More
|
| Private Build |
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- 2+ executable sections
- CryptUnprotectData
- GetConsoleWindow
- HighEntropy
- imgui
- Installer Version
- No Version Info
- ntdll
- VirtualAllocExNuma
- VirtualQueryEx
Show More
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,070 |
|---|---|
| Potentially Malicious Blocks: | 6 |
| Whitelisted Blocks: | 1,064 |
| Unknown Blocks: | 0 |
Visual Map
0
0
1
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
1
1
1
1
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
2
0
1
1
0
0
0
0
0
1
2
3
1
0
0
1
0
0
2
2
1
0
0
0
0
0
0
1
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
3
1
1
1
1
1
0
1
0
0
0
0
0
x
x
x
x
x
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.GDFA
- DarkGate.B
- Expiro.IE
- Expiro.KA
- Expiro.MA
Show More
- Expiro.MB
- Filecoder.SI
- Lamer.H
- RABased.C
- Stealer.BPE
- Tofsee.BG
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\2145062.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\2145062_2145062.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\2145079 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\2145671 | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\adobe updater.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\adobe updater.exe | Synchronize,Write Data |
| c:\users\user\appdata\roaming\r0 | Synchronize,Write Data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\run::updater adb | C:\Users\Qalqrvcv\AppData\Roaming\Adobe Updater.exe | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Service Control |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| User Data Access |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open Explorer.exe c:\users\user\downloads
|
(NULL) C:\Users\Qalqrvcv\AppData\Local\Temp\2145062.exe C:\Users\Qalqrvcv\AppData\Local\Temp\2145062_2145062.exe
|
"C:\Users\Jzarbndl\AppData\Local\BraveSoftware\Update\BraveUpdate.exe" /c
|
