What is “ML/PE-A + W32/Expiro-AV”?

The ML/PE-A + W32/Expiro-AV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What ML/PE-A + W32/Expiro-AV virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine ML/PE-A + W32/Expiro-AV?


File Info:
name: FE070F780A596CE70BDA.mlw
path: /opt/CAPEv2/storage/binaries/197df14ad99104abe1dc5ae411e7917ef65771f76c761d97de54861a52f300cc
crc32: 39BBE6E4
md5: fe070f780a596ce70bda703680ff0b19
sha1: 8fe445514d01118bbcadc27569c20fc1a48656fd
sha256: 197df14ad99104abe1dc5ae411e7917ef65771f76c761d97de54861a52f300cc
sha512: 245bb89cfc28fcb38fec6a0c3f0e3f26b9ac47a50bcb9938f59e6ab5abffb2f25163cb05d54c293458db011553c249b85da0f18aa9c460a00d71d3a5b6d25195
ssdeep: 24576:YJW2KjJ4Td3kJnbsPhnzq1HXG8VdOpNF3TYICC:YInJ4Td3mbsPhne13NdsNtCC
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T16B059E83628442C0DE7A6D335A37B7C712F62DB5FE949BC55DF8B83908B06C058199BB
sha3_384: 5ed6877d1ee9c7236528ea0f7a0eddcfe4a10ffee0980f5335ddaeda5bd08a0f1e247ccf7fc3c040b3c57dde33300e8a
ep_bytes: 525053ba18000000648b0203c201d08b
timestamp: 2047-08-21 01:47:02

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows PowerShell
FileVersion: 10.0.17134.1 (WinBuild.160101.0800)
InternalName: POWERSHELL
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: PowerShell.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17134.1
Translation: 0x0409 0x04b0

ML/PE-A + W32/Expiro-AV also known as:

Lionic	Virus.Win32.Expiro.n!c
Elastic	malicious (high confidence)
DrWeb	Win32.Expiro.153
MicroWorld-eScan	Win32.Expiro.Gen.6
FireEye	Generic.mg.fe070f780a596ce7
ALYac	Win32.Expiro.Gen.6
Cylance	Unsafe
K7AntiVirus	Virus ( 00580a951 )
Alibaba	Virus:Win32/Expiro.b72207c8
K7GW	Virus ( 00580a951 )
Cybereason	malicious.80a596
BitDefenderTheta	Gen:NN.ZexaF.34062.Zu0@aG5N32fi
Cyren	W32/Expiro.AH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Expiro.NDJ
Paloalto	generic.ml
ClamAV	Win.Virus.Expiro-9891445-0
Kaspersky	HEUR:Virus.Win32.Expiro.gen
BitDefender	Win32.Expiro.Gen.6
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:Xpirat-C [Inf]
Tencent	Virus.Win32.Expiro.ns
Ad-Aware	Win32.Expiro.Gen.6
Sophos	ML/PE-A + W32/Expiro-AV
VIPRE	Virus.Win32.Expiro.dp (v)
McAfee-GW-Edition	Artemis!Virus
Emsisoft	Win32.Expiro.Gen.6 (B)
Ikarus	Virus.Win32.Expiro
GData	Win32.Expiro.Gen.6
Avira	TR/Patched.Gen
Antiy-AVL	Trojan/Generic.ASVirus.30E
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
MAX	malware (ai score=85)
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Malware.AI.3317527010
APEX	Malicious
SentinelOne	Static AI – Suspicious PE
MaxSecure	virus.win64.expiro.gen
Fortinet	W32/Expiro.NDG!tr
AVG	Win32:Xpirat-C [Inf]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove ML/PE-A + W32/Expiro-AV?

ML/PE-A + W32/Expiro-AV removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X