Virus:Win32/Expiro.EK!MTB information

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: B4EBDD108982312804CD.mlw
path: /opt/CAPEv2/storage/binaries/c4bab87566c990f8d2ee8c536656af1b8740cfc5e9fe8b05598fde037395367f
crc32: 7D746F1B
md5: b4ebdd108982312804cdaacd8e7d125a
sha1: 1919cfd2649046353d03f4df91491b5045873f67
sha256: c4bab87566c990f8d2ee8c536656af1b8740cfc5e9fe8b05598fde037395367f
sha512: e5c77c454276962ce4f1be1222895c36cf56047045831072cca739d108244d483392bdc8c136d12312c9eedf6deb361a9a657555325ffffe646f0fc6215872e9
ssdeep: 12288:aqFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:aq8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1E2C4236B694DB183DA160570C5FCF1E46A4A3FF87A46DE36B2783B1A0174CDAC81486F
sha3_384: a3000c4efc991169dc1c16e0bca24aacf046133b0959991c4ee525e98fd7084e929170bc0d3f2477b10b7a543a9710c4
ep_bytes: e884170900e974feffff3b0d14304000
timestamp: 2023-01-11 11:34:03

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft® Linker Stub
FileVersion: 14.29.30148.0 built by: cloudtest
InternalName: DUMPBIN.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: DUMPBIN.EXE
ProductName: Microsoft® Visual Studio®
ProductVersion: 14.29.30148.0
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.