Gazavat / Expiro DMSniff connection and DGA analysis

By: Jason Reaves and Joshua Platt

Gazavat, also known at least partially as Expiro, is a multi-functional backdoor that has code overlaps with the POS malware DMSniff[1]. Functionality includes:

• Loading other executables


• Load hash cracking plugin


• Load DMSniff plugin


• Perform webinjection and webfakes


• Form grabbing


• Command execution


• Download file from infected system


• Convert infection into proxy


• DDOS


• Spreading and EXE infecting

Recovered Gazavat manual:

Technical Overview

Gazavat, along with a few other malware variants over the years, have all been …

analysis backdoor code command cracking dga download file grabbing hash hash cracking jason malware plugin pos pos malware system