Virus

Virus:Win32/Expiro.EK!MTB information

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • CAPE detected the shellcode patterns malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: C313DF5728DE62EF75A5.mlw
path: /opt/CAPEv2/storage/binaries/4a9ca971a88568d06b97e64ac18174a492af3be32dce5024d74159e542eea5d1
crc32: 8BAD19A5
md5: c313df5728de62ef75a5f0d7ef0b58b3
sha1: ac9162b67358165e70442e79860638bf6f4d37a3
sha256: 4a9ca971a88568d06b97e64ac18174a492af3be32dce5024d74159e542eea5d1
sha512: 62e70ad584ad2dba755ffe49ce7902e6c6f7d3acd265b8a4c09374dea13654c450058d3e0c97511abc670607ebc3bd0a0bc71ae11875ceb259838b73a2c99862
ssdeep: 12288:A+/q5dXoPi6HElWrCx+fgppMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:A+/qoiZMrCxuYSSkQ/7Gb8NLEbeZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F0650111B0E180B2E0B30A350DF899704EBDBD720B21AE3F27D45B2E5F75691D52AE72
sha3_384: 21d72afdceba74437e3101ee2416efd862b5421dc07456d92de7b6cd44405ef37a6c36ee1c9f47423a959b6f86a1cc59
ep_bytes: e873050000e97afeffff558bec6a00ff
timestamp: 2021-07-27 00:26:21


Version Info:

CompanyName: Google LLC
FileDescription: Google Update Core
FileVersion: 1.3.36.101
InternalName: Google Update
LegalCopyright: Copyright 2018 Google LLC
OriginalFilename: GoogleUpdate.exe
ProductName: Google Update
ProductVersion: 1.3.36.101
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.7
ClamAVWin.Trojan.Filerepmalware-10008115-0
FireEyeGeneric.mg.c313df5728de62ef
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Generic.tm
Cylanceunsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
AlibabaVirus:Win32/Expiro.70a89e45
K7GWVirus ( 005a8b911 )
K7AntiVirusVirus ( 005a8b911 )
SymantecW32.Xpiro.J!dam
ESET-NOD32a variant of Win32/Expiro.NDX
APEXMalicious
CynetMalicious (score: 100)
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
AvastWin32:FileInfector-C [Heur]
TencentVirus.Win32.VirMoiva.a
TACHYONVirus/W32.Movia
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.158
VIPREWin32.Expiro.Gen.7
TrendMicroVirus.Win32.EXPIRO.JMA
Trapminemalicious.moderate.ml.score
SophosW32/Moiva-C
IkarusTrojan.Patched
GDataWin32.Trojan.PSE.JB13RC
GoogleDetected
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
ArcabitWin32.Expiro.Gen.7
ZoneAlarmVirus.Win32.Moiva.a
MicrosoftVirus:Win32/Expiro.EK!MTB
VaristW32/Expiro.AU.gen!Eldorado
Acronissuspicious
ALYacWin32.Expiro.Gen.7
MAXmalware (ai score=82)
VBA32BScope.TrojanDownloader.Zenlod
MalwarebytesGeneric.Malware.AI.DDS
PandaW32/Moyv.A
RisingTrojan.Generic@AI.95 (RDML:rQT5Q2ierO6TLfyi1JdIYg)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/Expiro.NDP!tr
AVGWin32:FileInfector-C [Heur]
Cybereasonmalicious.673581
DeepInstinctMALICIOUS

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment