Expiro
Aliases: Xpiro
- First seen
- 2008-01-01 00:00:00
- Malware type
- credential-stealer, virus
- Family
- Malware family
- Last IoC activity
- 2026-07-21 17:56:41
- Profile updated
- 2026-07-07 14:58:14
Context
Expiro malware has been around for more than a decade, and the malware authors sill continue their work and update it with more features. Also the infection routine was changed in samples fround in 2017 (described by McAfee). Expiro "infiltrates" executables on 32- and 64bit Windows OS versions. It has capabilities to install browser extensions, change security behaviour/settings on the infected system, and steal information (e.g. account credentials). There is a newly described EPO file infector source code called m0yv in 2022, which is wrongly identified as expiro by some AVs.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Expiro_Auto (yara-rule)
Reports & references
- medium.com — Gazavat Expiro Dmsniff Connection And Dga Analysis 8B965Cc0221D (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Expiro (report)
- Microsoft — Malware Encyclopedia Description (report)
- McAfee — Expiro Infects Encrypts Files To Complicate Repair (report)
- ESET — Versatile And Infectious Win64Expiro Is A Cross Platform File Infector (report)
- youtu.be — 3Rybkortfnk (report)
- github.com — Report Malware (report)