Expiro

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Expiro
Alias	Xpiro
Group	Stealing, Click frauding
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Microsoft Windows
Origin
Distribution vector
UserAgent
CCProtocol	HTTP (Centralized)
Activity	Unknown / Unknown
Status	Unknown
Language
Programming language
Operation/Working group

Features

• Credit card data theft

• SOCKS

• HTTP proxy

• TCP flood

• Chrome browser extension

• Mozilla browser extension

• URL redirection

• FileZilla password theft

• Outlook password theft

• Internet Explorer password theft

• Cross-infection

Publications

	Author	Editor	Year
File infector Expiro hits US, steals FTP credentials	Rhena Inocencio	Trend Micro	2013
First widespread virus cross-infection	Jeet Morparia	Symantec	2013
Versatile and infectious: Win64/Expiro is a cross-platform file infector	Artem I. Baranov	ESET	2013