About “Virus:Win32/Expiro.EK!MTB” infection

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Arabic (Qatar)
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: 67779EEBCCDC5C9DB062.mlw
path: /opt/CAPEv2/storage/binaries/df92a4f0df0d832f26a96c4c1b3a00b29d98b248138d6cdba6521f099901d35f
crc32: C1B44004
md5: 67779eebccdc5c9db0621d4f1d72f442
sha1: 24f97b4d6da35071a09395bac0cb79f054ec4d02
sha256: df92a4f0df0d832f26a96c4c1b3a00b29d98b248138d6cdba6521f099901d35f
sha512: 06994e9b9103b4bf8c3eebe9b1e8cff4c5911511022bcc12bdf8602ff42f2f1fef0981f82daf9f5dac3c257aebb83239fd1d403d925729d3d9f9cb4b61dc7ab9
ssdeep: 12288:XpaVtaS0FiYcBkiM9/xh5qj+6jGNAKg0EqPceUg3pM3ZUzGXykf9dhmghFJkRbgN:ZaOBcS9/TYj+6G70Gm3ZUYy+vP8Rbgl
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T12165F110B989CFB2D55F0170DCA9ABF6526BED34CF1503D76384BE2A38746C26932663
sha3_384: 92e862e61504ffc9223a6da194be5639c003a50c5aea8a590a208ef6143a77aef2db5b1e4c235b642866883121f31d28
ep_bytes: e86bfd1400e968feffff8b4df464890d
timestamp: 2021-02-15 03:27:17

Version Info:
CompanyName: Adobe Systems Inc.
FileDescription: Adobe Create PDF plug-in listener for Chrome
FileVersion: 21.1.20138.422477
LegalCopyright: Copyright 1984-2021 Adobe Systems Incorporated
OriginalFilename: WCChromeNativeMessagingHost.exe
ProductName: Adobe Create PDF
ProductVersion: 21.1.20138.422477
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.