Malware

Win32/Expiro

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Spreads through... File infection Win32/Expiro infects .EXE files and files referenced by shortcut (.LNK) files. It looks for .EXE files that are registered as services, found in the Programs folder in the Start Menu, your desktop, and the local Applications Data folder. It also infects all .EXE files found in drives C to Z. Win32/Expiro infects files by appending its virus code to these files.

Persistence

1 technique

T1112Modify RegistryEvidence1

Win32/Expiro modifies the following settings via the system registry that affect the Internet Explorer security settings: In subkeys: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 ...

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Credentials entered by users in different windows, for example, in Internet Explorer

T1555Credentials from Password StoresEvidence1

Win32/Expiro collects the following sensitive information: Installed certificates Credentials stored by FileZilla Credentials stored by Windows Protected Storage

Discovery

1 technique

T1033System Owner/User DiscoveryEvidence1

It also sends information about your PC every time it connects to the remote server, including:

Collection

3 techniques

T1056.001KeyloggingEvidence1

Credentials entered by users in different windows, for example, in Internet Explorer

T1074Data StagedEvidence1

It logs the stolen credentials in the following non-malicious files: %LOCALAPPDATA% ... %APPDATA% ...

T1185Browser Session HijackingEvidence1

Win32/Expiro installs a Firefox extension that redirects web access from certain sites to others.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Win32/Expiro is able to connect to a server and receive commands from a remote malicious hacker. Some of the servers we have seen it connect to are: ...

T1105Ingress Tool TransferEvidence1

It can perform any of the following actions, based on the commands of the malicious hacker: ... Download malware components

T1568Dynamic ResolutionEvidence1

There is also a chance the malware will generate pseudo-random .com and .ru domains such as the following: <char>decub-ydyg.ru ...

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

It can perform any of the following actions, based on the commands of the malicious hacker: ... Collect and upload user credentials

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

The virus also disables Windows File Protection to infect protected files.

INDICATORS OF COMPROMISE

IOCs tracked for this family

51 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

51 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

microsoft wdsiNews

May 19, 2011

Win32/Expiro threat description - Microsoft Security Intelligence

A Windows file-infecting virus that appends its code to .EXE files, creates infected .IVR copies, disables Windows File Protection, steals credentials and certificates, installs a Firefox extension for web redirection, lowers Internet Explorer security settings, and provides remote backdoor access for command execution and downloading additional malware components.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching51

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Win32/Expiro

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Persistence

1 technique

T1112Modify RegistryEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Credentials entered by users in different windows, for example, in Internet Explorer

T1555Credentials from Password StoresEvidence1

Win32/Expiro collects the following sensitive information: Installed certificates Credentials stored by FileZilla Credentials stored by Windows Protected Storage

Discovery

1 technique

T1033System Owner/User DiscoveryEvidence1

It also sends information about your PC every time it connects to the remote server, including:

Collection

3 techniques

T1056.001KeyloggingEvidence1

Credentials entered by users in different windows, for example, in Internet Explorer

T1074Data StagedEvidence1

It logs the stolen credentials in the following non-malicious files: %LOCALAPPDATA% ... %APPDATA% ...

T1185Browser Session HijackingEvidence1

Win32/Expiro installs a Firefox extension that redirects web access from certain sites to others.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Win32/Expiro is able to connect to a server and receive commands from a remote malicious hacker. Some of the servers we have seen it connect to are: ...

T1105Ingress Tool TransferEvidence1

It can perform any of the following actions, based on the commands of the malicious hacker: ... Download malware components

T1568Dynamic ResolutionEvidence1

There is also a chance the malware will generate pseudo-random .com and .ru domains such as the following: <char>decub-ydyg.ru ...

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

It can perform any of the following actions, based on the commands of the malicious hacker: ... Collect and upload user credentials

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

The virus also disables Windows File Protection to infect protected files.

INDICATORS OF COMPROMISE

IOCs tracked for this family

51 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

51 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

microsoft wdsiNews

May 19, 2011

Win32/Expiro threat description - Microsoft Security Intelligence

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching51

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.