PE_EXPIRO.A3

This file infector modifies the Internet Explorer Zone Settings.

It connects to certain websites to send and receive information.

Arrival Details

This malware arrives via the following means:

• as a file infected by PE_EXPIRO mother file
• may be downloaded unknowingly when visiting malicious websites

Installation

This file infector drops the following files:

• %System%\{random filename}.tmp - also detected as PE_EXPIRO.A3 contains the content of target file with expiro malicious code
• %System%\cisvc.exe - also detected as PE_EXPIRO.A3

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• kkq-vx_mtx{number}
• gazavat-svc

Other System Modifications

This file infector modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

File Infection

This file infector infects the following files:

• .EXE

It infects the following file types in shared networks to ensure its propagation:

• .EXE

Web Browser Home Page and Search Page Modification

This file infector modifies the Internet Explorer Zone Settings.

Information Theft

This file infector gathers the following data:

• Windows Product ID
• Drive Volume Serial Number
• OS Version
• User credentials
• Information from Filezilla

Other Details

This file infector connects to the following website to send and receive information:

• {random generated 1}-{random generated 2}.com
• {random generated 1}-{random generated 2}.ru

It does the following:

• It infects files executable files with .EXE extensions and files referenced by shortcut (.LNK) files, starting in the Start Menu Programs directory then passes through the directory until it reaches the %Desktop% folder.
• Since it infects Start up programs, it serves as its auto-start mechanism.
• It searches drives from C:\ to Z:\ and infects all found .EXE files. Thus, the drives shared through the network will be infected.

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)