Categories: Virus

About “Virus.Win64.Expiro.e” infection

The Virus.Win64.Expiro.e is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus.Win64.Expiro.e virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Dynamic (imported) function loading detected
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

wpad.local-net

How to determine Virus.Win64.Expiro.e?


File Info:
name: EC9D6AB9B281ADBED115.mlwpath: /opt/CAPEv2/storage/binaries/19290345b4a6088817dbf2381cf2bcb1e603ae33777d831ae5bf6bef652953cccrc32: 7D4738B7md5: ec9d6ab9b281adbed115894ec15ab43dsha1: 573f2c983098ddc36cb5a24652bbab2e25207fc3sha256: 19290345b4a6088817dbf2381cf2bcb1e603ae33777d831ae5bf6bef652953ccsha512: e18ce7b61324f10009a9556b1c6ce4f971de8b5c5d49b8f054d6810d5c84285fb2a930504bec2d600dd77a652a4290eb1171fcfc73208ea246afe847baaac82assdeep: 12288:Vdz2DWU1t8LIHmOncl+5HkPj4pOuQ/83EJjYB8lchAQrwzqc8fBtcVVpymGPBQWH:7z2DWOt88NE4Y/Q8GZc8IVVyH6OjsWtype: PE32+ executable (GUI) x86-64, for MS Windowstlsh: T126E48E76DC128973DB6B457E7C5C2A2C017E8504DB90ABCBEB0AD691E9523EE4C7E130sha3_384: a1ba3c90260ff9a25b0db5c7466d1ec65c810d6662ef48ff6cb126d4d5ddc7b356b4d7a1d55d738301f72af4bdee3c81ep_bytes: 90554889e55648ffce57415441554156timestamp: 2009-06-04 03:59:28
Version Info:
CompanyName: Microsoft CorporationFileDescription: .NET Runtime Optimization ServiceFileVersion: 2.0.50727.4927 (NetFXspW7.050727-4900)InternalName: mscorsvw.exeLegalCopyright: © Microsoft Corporation.  All rights reserved.OriginalFilename: mscorsvw.exeProductName: Microsoft® .NET FrameworkProductVersion: 2.0.50727.4927Comments: Flavor=RetailTranslation: 0x0409 0x04b0

Virus.Win64.Expiro.e also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Win64.Expiro.Gen.3
FireEye	Generic.mg.ec9d6ab9b281adbe
ALYac	Win64.Expiro.Gen.3
Cylance	Unsafe
Zillya	Virus.Expiro.Win64.34
K7AntiVirus	Virus ( 0040f8071 )
K7GW	Virus ( 0040f8071 )
Cybereason	malicious.9b281a
Baidu	Win64.Virus.Expiro.r
Cyren	W64/Expiro.D!gen
Symantec	W64.Xpiro.F
ESET-NOD32	Win64/Expiro.AG
APEX	Malicious
Kaspersky	Virus.Win64.Expiro.e
BitDefender	Win64.Expiro.Gen.3
NANO-Antivirus	Virus.Win64.Expiro.dtfhve
Avast	Win32:Expiro-DD
Tencent	Virus.Win64.Expiro.ad
Ad-Aware	Win64.Expiro.Gen.3
TACHYON	Virus/W64.Expiro.C
Sophos	ML/PE-A + W64/Expiro-S
DrWeb	Win64.Expiro.108
VIPRE	Virus.Win64.Expiro.gen.a (v)
TrendMicro	PE64_EXPIRO.AR
McAfee-GW-Edition	BehavesLike.Win64.Virut.jc
Emsisoft	Win64.Expiro.Gen.3 (B)
Ikarus	Virus.Win32.Expiro
GData	Win64.Expiro.Gen.3
Webroot	W32.Virus.Win64.Expiro
Avira	W64/Expiro.AF
Antiy-AVL	Trojan/Generic.ASVirus.2BB
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Win64/Expiro2.Gen
Acronis	suspicious
McAfee	W64/Expiro.a
MAX	malware (ai score=84)
TrendMicro-HouseCall	PE64_EXPIRO.AR
Rising	Virus.Expiro!1.A140 (CLASSIC)
SentinelOne	Static AI – Malicious PE
Fortinet	W64/Expiro.Q
AVG	Win32:Expiro-DD
Panda	W32/Expiro.gen
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	virus.win64.expiro.gen