Skip to content
MalwareWiki

Malware

Gazavat

Gazavat (which is often tagged as Expiro by AV vendors) is a multi-functional backdoor that has code overlaps with the POS malware DMSniff.

Gazavat is a Windows malware family.

Background

Gazavat, frequently labeled Expiro by antivirus vendors, is a versatile backdoor that shares code with the POS malware DMSniff. Its capabilities include:

  • Loading other executables
  • Load hash cracking plugin
  • Load DMSniff plugin
  • Perform webinjection and webfakes
  • Form grabbing
  • Command execution
  • Download file from infected system
  • Convert infection into proxy
  • DDOS
  • Spreading and EXE infecting

Source: Malpedia (Fraunhofer FKIE).