[rkhunter]

Virus:Win32/Expiro.AX

MD5: 5421DC4A41E3BF3840E1EE03E3EDD2F7
https://www.virustotal.com/file/9b0a600 ... /analysis/

[Aleksandra]

MD5: 6ad655563c28c36f90a009ac78feaab1
SHA1: 37d8e65b7109a28d3cb253829bdb0f5decbf96d9
12/41

Infected files attached.

[EP_X0FF]

Win32/Expiro.BD in attach.

SHA256: 1a0e3a6ec64bc1a7301f113c797e6620feda24030f5037214cc1d2f000354d4e
SHA1: cf95e3a56836285fa8a3f5408ef23108de9d8d77
MD5: 195deba36bc846f4f6b29cf86862b565

https://www.virustotal.com/en/file/1a0e ... 364365902/

Refer to encyclopedia entry for more info.

[rkhunter]

aka Win64/Expiro.A

http://www.symantec.com/security_respon ... 99&tabid=2
http://blog.trendmicro.com/trendlabs-se ... edentials/

infected Wmiprvse.exe [6.2.9200.16398 / WMI Provider Host] in attach

[Blaze]

Versatile and infectious: Win64/Expiro is a cross-platform file infector
http://www.welivesecurity.com/2013/07/3 ... -infector/


Win64/Expiro.A - 469fcc15b70cae06f245cec8fcbf50f7c55dcc4b
Win32/Expiro.NBF - 9818d4079b9cb6b8a3208edae0ac7ad61a85d178

[Cody Johnston]

Expiro infected powercfg.exe

MD5: 2b37446d6cc0bb88321488c567c30f5f

https://www.virustotal.com/en/file/c12d ... 375491855/

[Cody Johnston]

This is likely the dropper for the file posted above:

3/46

MD5: 4928fa5ed61c213b66ae8036a96037d1

https://www.virustotal.com/en/file/4b45 ... /analysis/

Does anyone know of a working removal tool for this variant? The AVG remover is not working as expected.

[K_Mikhail]

hxxp:// walzpainting.com / gaz.exe from Malc0de links (infected \drwtsn32.exe)

https://www.virustotal.com/ru/file/16bb ... 377021758/

[Mosh]

Win32/Expiro and Postbank phishing site on 178.211.45.186 (Turkey)

SHA256: 2594b3b280d60bb7d19687de48bca90b260c4ad13171f6ecb67f5968eab024b5
SHA1: 5649d1dc81eba450cec8f67b10232718ee0add8f
MD5: 4d6d41cf255d73e278ed2eef43432fc3
File size: 574.0 KB ( 587776 bytes )
File name: usbhost.exe
File type: Win32 EXE
Tags: peexe
Detection ratio: 27 / 48
https://www.virustotal.com/en/file/2594 ... 379690433/

Postbank site: http://urlquery.net/report.php?id=5625934

[Cody Johnston]

All these found on the same PC yesterday. Includes Expiro, Buzus and Symmi.

Expiro

SHA256: 537787a529c820dbafa3ce43e93f4a1c12f0d957e86d691285afe7ae8ca36b8a
SHA1: be9e892b38698bc6e1b4dee946f15e984d72e2a0
MD5: f2601abb1c460023658a2e6d357efb42
Detection ratio: 32 / 48

https://www.virustotal.com/en/file/5377 ... 379624778/


Buzus

SHA256: 4576b2c909a9a4c06aa64846769d6f62e845235c3ac4af793b3a5b5c5f76a873
SHA1: 2270b7859a6309d23bf6d816a8bca4ff43e353c0
MD5: 17866d1d370ef87d631817c93939ebff
Detection ratio: 20 / 46

https://www.virustotal.com/en/file/4576 ... /analysis/


Symmi

SHA256: 4cb4d564303baabdbaa2a9ea0bb1ce542b3498882a4695bf4de8226da2883503
SHA1: 10051817a0e164f8724330ae1dd3e1133dcb1753
MD5: 6308daca641d6314d0751e906a596519
Detection ratio: 6 / 48

https://www.virustotal.com/en/file/4cb4 ... /analysis/