Virus

About “Virus:Win32/Expiro.EK!MTB” infection

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: 273505B49568277CFB83.mlw
path: /opt/CAPEv2/storage/binaries/24b554e94065094b4cb2b96fa42cdc8e3a57227e5641eb0dedef65833a06a73d
crc32: 40F8F77F
md5: 273505b49568277cfb8336a6c877bbcd
sha1: bd704c25b85e99823051a81b11fa45d175ff0af8
sha256: 24b554e94065094b4cb2b96fa42cdc8e3a57227e5641eb0dedef65833a06a73d
sha512: 29450d337ee66130fd6f5fdb0dfb4bc18692422eb0f2e2cd46e1a8efa8eae9f42cf61ff0cc046ab7c314a3b4969e44f9d4cc836471d5e96a6eea2a7c613e09a6
ssdeep: 49152:7OpO8ZojCyBvTi+08O+78zYEMQWLkbgPecX6VqvOh/snji6attJM:m8O+7MYhQWLkb2WEnW6at
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T10E95D063728180B1EAB2293045BD1F3468BB6D349FF285CB93C85A2D6F316D64E39357
sha3_384: 204cb69f03f709ee9f2c4792594d3c73e05dc5ce75c4214d8611753b6bae123eeaf9680a879bdbfa17e05ee569695ef5
ep_bytes: e8d30d0000e968feffff3b0dd0285300
timestamp: 2055-09-09 16:47:57


Version Info:

CompanyName: Microsoft Corporation
FileDescription: mt2.exe
FileVersion: 10.0.19041.685 (WinBuild.160101.0800)
InternalName: mt2.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: mt2.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.685
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
LionicVirus.Win32.Expiro.n!c
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.7
FireEyeGeneric.mg.273505b49568277c
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Trojan.tc
ALYacWin32.Expiro.Gen.7
Cylanceunsafe
K7AntiVirusVirus ( 005a8b911 )
K7GWVirus ( 005a8b911 )
ArcabitWin32.Expiro.Gen.7
SymantecW32.Xpiro.J!dam
ESET-NOD32Win32/Expiro.CU
CynetMalicious (score: 99)
APEXMalicious
ClamAVWin.Malware.Expiro-9941636-0
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
AvastWin32:FileInfector-C [Heur]
TencentVirus.Win32.VirMoiva.a
TACHYONVirus/W32.Movia
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.153
VIPREWin32.Expiro.Gen.7
TrendMicroVirus.Win32.EXPIRO.JMA
Trapminemalicious.moderate.ml.score
SophosW32/Moiva-A
IkarusVirus.Win32.Expiro
VaristW32/Expiro.AU.gen!Eldorado
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
GridinsoftRansom.Win32.Sabsik.sa
MicrosoftVirus:Win32/Expiro.EK!MTB
ZoneAlarmVirus.Win32.Moiva.a
GDataWin32.Expiro.Gen.7
GoogleDetected
MAXmalware (ai score=81)
VBA32Trojan.Sabsik.TE
MalwarebytesVirus.M0yv
PandaW32/Moyv.A
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/Expiro.NDP!tr
AVGWin32:FileInfector-C [Heur]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment