What is “Virus:Win32/Expiro.EK!MTB”?

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family

How to determine Virus:Win32/Expiro.EK!MTB?


File Info:
name: A41FB9E45F11E3C39AC7.mlw
path: /opt/CAPEv2/storage/binaries/b6ec23be3dfc273366ec2ff4f3e6409d0d83ae8fdc37a14cd05ec9fc8acddf5c
crc32: 415F41A2
md5: a41fb9e45f11e3c39ac7bffe75345fc3
sha1: 85a3d0192313a6907f9d839f1a700a8fb2d8ef1c
sha256: b6ec23be3dfc273366ec2ff4f3e6409d0d83ae8fdc37a14cd05ec9fc8acddf5c
sha512: 3a31bfcde3bbc62d99b910f5fcc788774cfc3963236521796d263d086c12365d947b38120f72fd0d86964066d3bd243832330e473b66026f5dc104fb0077238a
ssdeep: 49152:hU/XJxujtSm55BLCArVQPjlTxG+8rnP1n/iyklrfPOkhqvq:mxgc+BOA5qjlTxcruOkf
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1E2B5BF2263D51179F3B327306A6A7655496BFE715A3184CF53C80A0E2B73AC0EA75B33
sha3_384: 181be7d5a542e3f946c09ed8ecafbcd273b85b59a6638337c304e442ed2dd3cc84bb853aca41b53807d50301dd821b2e
ep_bytes: e8f63b1f00e974feffff3b0d14105a00
timestamp: 2023-01-11 11:34:52

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft® Incremental Linker
FileVersion: 14.29.30148.0 built by: cloudtest
InternalName: LINK.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: LINK.EXE
ProductName: Microsoft® Visual Studio®
ProductVersion: 14.29.30148.0
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Virus.Win32.Expiro.n!c
AVG	Win32:Dh-A [Heur]
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Expiro.Gen.7
FireEye	Generic.mg.a41fb9e45f11e3c3
CAT-QuickHeal	W32.Expiro.R3
Skyhigh	BehavesLike.Win32.Sality.vc
McAfee	Artemis!A41FB9E45F11
Malwarebytes	Generic.Malware.AI.DDS
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Virus ( 005a8b911 )
K7AntiVirus	Virus ( 005a8b911 )
Symantec	W32.Xpiro.J!dam
ESET-NOD32	a variant of Win32/Expiro.NDP
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Virus.Expiro-9935160-0
Kaspersky	Virus.Win32.Moiva.a
BitDefender	Win32.Expiro.Gen.7
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Avast	Win32:Dh-A [Heur]
Emsisoft	Win32.Expiro.Gen.7 (B)
F-Secure	Malware.W32/Infector.Gen
DrWeb	Win32.Expiro.158
VIPRE	Win32.Expiro.Gen.7
TrendMicro	Virus.Win32.EXPIRO.JMA
Trapmine	malicious.high.ml.score
Sophos	W32/Moiva-C
SentinelOne	Static AI – Malicious PE
Varist	W32/Expiro.AU.gen!Eldorado
Avira	W32/Infector.Gen
MAX	malware (ai score=88)
Antiy-AVL	Virus/Win32.Expiro.x
Microsoft	Virus:Win32/Expiro.EK!MTB
Arcabit	Win32.Expiro.Gen.7
ZoneAlarm	Virus.Win32.Moiva.a
GData	Win32.Expiro.Gen.7
Google	Detected
AhnLab-V3	Virus/Win.Expiro.X2210
VBA32	Trojan.Sabsik.TE
ALYac	Win32.Expiro.Gen.7
TACHYON	Virus/W32.Movia
Cylance	unsafe
Panda	W32/Moyv.A
Rising	Trojan.Generic@AI.97 (RDML:FbfSUD9bLGO+prgO3jR7Cg)
Ikarus	Expiro.Win32
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/FileInfector.C!tr
Cybereason	malicious.45f11e
DeepInstinct	MALICIOUS

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X