About “Win32/ExtenBro.EV” infection

The Win32/ExtenBro.EV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/ExtenBro.EV virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Win32/ExtenBro.EV?


File Info:
name: A42F6BBC96412CF66A0F.mlw
path: /opt/CAPEv2/storage/binaries/fc0dda4f8f3aaf6b182e9c800bc155f5d01195afa1b46488d8d06bd9f484b3e0
crc32: 0A182171
md5: a42f6bbc96412cf66a0f8e2ce692e9ae
sha1: 39ea31a3276ce76dca291878a328e55da4d883d0
sha256: fc0dda4f8f3aaf6b182e9c800bc155f5d01195afa1b46488d8d06bd9f484b3e0
sha512: adb618d59c76077660dc023977b403e71490bbd260126096fc623cedb097b15eedb664513a61218b636ebbdf7433d9c91cdf3373d36c11394c29af2d44a828fa
ssdeep: 6144:OVVCFmUMaRpGe7BzfRO8bTdJxrTByYEdnhDqlRVxyTheqz3Qf5OIXI+d9q9:iYLMa/O8bJJxrTIYEyeUqFIZ9q9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14894CF11FA89C131D8F3023195FE9B69457D79390724A8CBF3886A6D38721D32B3679B
sha3_384: 1092e218b34dd719feee69fba5983238ec0f73a58186a2274427a6c477e847b1f98cb29176408c7194240bbb00d354ad
ep_bytes: e8242b0000e97ffeffff3b0d50420c00
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Win32/ExtenBro.EV also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Malicious.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.EmotetU.Gen.zuW@hCitJVki
FireEye	Generic.mg.a42f6bbc96412cf6
McAfee	Artemis!A42F6BBC9641
Cylance	Unsafe
K7AntiVirus	Trojan ( 00543a061 )
Alibaba	Trojan:Win32/ExtenBro.74d386d9
CrowdStrike	win/malicious_confidence_60% (W)
BitDefenderTheta	Gen:NN.ZexaF.34294.zuW@aCitJVki
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/ExtenBro.EV
TrendMicro-HouseCall	TROJ_GEN.R053H0CKQ21
Paloalto	generic.ml
BitDefender	Trojan.EmotetU.Gen.zuW@hCitJVki
Avast	Win32:DropperX-gen [Drp]
Tencent	Win32.Trojan.Emotetu.Ljtv
Ad-Aware	Trojan.EmotetU.Gen.zuW@hCitJVki
Sophos	Generic ML PUA (PUA)
Emsisoft	Trojan.EmotetU.Gen.zuW@hCitJVki (B)
Ikarus	Win32.Outbreak
Avira	TR/Dropper.Gen
MAX	malware (ai score=88)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Trojan.EmotetU.Gen.zuW@hCitJVki
Cynet	Malicious (score: 100)
ALYac	Trojan.EmotetU.Gen.zuW@hCitJVki
Malwarebytes	MachineLearning/Anomalous.100%
APEX	Malicious
Yandex	Trojan.GenAsa!YPyuE9TLa98
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/ExtenBro.EV!tr
AVG	Win32:DropperX-gen [Drp]
Cybereason	malicious.c96412

How to remove Win32/ExtenBro.EV?

Win32/ExtenBro.EV removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X