Virus

Virus:Win32/Expiro.EK!MTB (file analysis)

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: 7F3617C2FCE9E246780D.mlw
path: /opt/CAPEv2/storage/binaries/335b9db659c6cfdfed8ff30ac175e4e0c0e0ff40afd542f255d3f072b6694490
crc32: 5BB563D6
md5: 7f3617c2fce9e246780de5193052cd02
sha1: 456e332e8fd9ee15133c52a784def4a0156399a0
sha256: 335b9db659c6cfdfed8ff30ac175e4e0c0e0ff40afd542f255d3f072b6694490
sha512: 14eb20e6ad2e815a4954800f389e56b98ef8a55c50a39744f4f289282807833840c3b76b7888d158fe6b261c7bf52e93e66beb251cc5fe71873d4fc0c90fcbb4
ssdeep: 24576:skDp/Y0/cssv/sBpmpMRajtfIUNJ4IHmu1DnynQf:seussv/CpmpMgjtrrhDyQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11265F102760610F0D54B62717C2FFB36DB2448181B2A49D7E7C8BF5BDEBA2E1683694D
sha3_384: 7273108dee0fa7e5c97cd16cbfc0c2e9499b2d83b1f5080c5b5b0fde30c5503192ddc99ecb39fc7b06a340ef66fd6394
ep_bytes: e81bcf0a00e978feffff558bec51833d
timestamp: 2023-09-18 16:09:25


Version Info:

Comments: 
LegalCopyright: License: MPL 2
CompanyName: Mozilla Foundation
FileDescription: 
FileVersion: 118.0
ProductVersion: 118.0
InternalName: 
LegalTrademarks: Mozilla
OriginalFilename: crashreporter.exe
ProductName: Firefox
BuildID: 20230918143747
Translation: 0x0000 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
LionicVirus.Win32.Expiro.n!c
AVGWin32:Xpirat-B [Inf]
MicroWorld-eScanWin32.Expiro.Gen.7
FireEyeGeneric.mg.7f3617c2fce9e246
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Generic.tt
McAfeeArtemis!7F3617C2FCE9
MalwarebytesMalware.Heuristic.2009
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 0059041f1 )
AlibabaVirus:Win32/Expiro.a21a7fe3
K7GWVirus ( 0059041f1 )
CrowdStrikewin/malicious_confidence_100% (D)
SymantecW32.Xpiro.J!dam
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Expiro.NDX
CynetMalicious (score: 100)
APEXMalicious
AvastWin32:Xpirat-B [Inf]
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.158
VIPREWin32.Expiro.Gen.7
TrendMicroVirus.Win32.EXPIRO.JMA
SophosW32/Moiva-C
SentinelOneStatic AI – Malicious PE
VaristW32/Expiro.AU.gen!Eldorado
AviraW32/Infector.Gen
MAXmalware (ai score=84)
Antiy-AVLVirus/Win64.Expiro.ce
MicrosoftVirus:Win32/Expiro.EK!MTB
ArcabitWin32.Expiro.Gen.7
ZoneAlarmVirus.Win32.Moiva.a
GDataWin32.Expiro.Gen.7
GoogleDetected
VBA32BScope.TrojanDownloader.Zenlod
ALYacWin32.Expiro.Gen.7
TACHYONVirus/W32.Movia
Cylanceunsafe
PandaW32/Moyv.A
TencentVirus.Win32.VirMoiva.a
IkarusTrojan.Win32.Patched
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/FileInfector.C!tr
Cybereasonmalicious.2fce9e
DeepInstinctMALICIOUS
alibabacloudVirus:Win/Expiro.A

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment