Malware

How to remove “BAT/CoinMiner.ATM”?

Malware Removal

The BAT/CoinMiner.ATM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What BAT/CoinMiner.ATM virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Guard pages use detected – possible anti-debugging.
  • A process attempted to delay the analysis task.
  • Dynamic (imported) function loading detected
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Installs itself for autorun at Windows startup
  • A cryptomining command was executed
  • Binary compilation timestomping detected
  • Uses suspicious command line tools or Windows utilities

How to determine BAT/CoinMiner.ATM?



File Info:

name: 98C7C4F2C32400587AE5.mlw
path: /opt/CAPEv2/storage/binaries/d5623861ab4f90f550bc399c438cf5917416c0dacd5e487486b5192fec2a7231
crc32: 59E602E3
md5: 98c7c4f2c32400587ae5afd97b9a452a
sha1: a9d6e64200d9ec6491deafcba71e7bba3be49f97
sha256: d5623861ab4f90f550bc399c438cf5917416c0dacd5e487486b5192fec2a7231
sha512: cf8ea95ab63b3f8f45c3900f8402676258c0f477ece6dda5c5172dda9c2f45b842a4a2170bdf2c6da0ffc97452729819357146567f4fc9c8efb7d309b137b602
ssdeep: 3072:J18c7+01i5GWp1icKAArDZz4N9GhbkrNEk1IhMP:r8c7+fp0yN90QEC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D0E39E53B7D88033D9B52BB058F613C30B36BCA15D78836B2785A95E0DB3684A53277B
sha3_384: 5a24570449efe0e0fa85ffc818e1062aefad87306078d25529e5655613508d974e437de0cc1cb646e2eafd7c65f50b81
ep_bytes: e88e060000e9000000006a5c68007340
timestamp: 2100-01-12 05:50:52


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 11.00.17134.1 (WinBuild.160101.0800)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17134.1
Translation: 0x0409 0x04b0

BAT/CoinMiner.ATM also known as:

MicroWorld-eScanTrojan.GenericKD.38139233
FireEyeGeneric.mg.98c7c4f2c3240058
McAfeeRDN/Generic.grp
CylanceUnsafe
K7AntiVirusTrojan ( 00581e2f1 )
K7GWTrojan ( 00581e2f1 )
CrowdStrikewin/malicious_confidence_60% (W)
SymantecML.Attribute.HighConfidence
ESET-NOD32BAT/CoinMiner.ATM
KasperskyHEUR:Trojan.BAT.Miner.gen
BitDefenderTrojan.GenericKD.38139233
SUPERAntiSpywareTrojan.Agent/Gen-Downloader
AvastOther:Malware-gen [Trj]
TencentBat.Trojan.Miner.Hwct
Ad-AwareTrojan.GenericKD.38139233
McAfee-GW-EditionRDN/Generic.grp
EmsisoftTrojan.GenericKD.38139233 (B)
GDataTrojan.GenericKD.38139233
AviraBAT/CoinMiner.AR
MicrosoftTrojan:Win32/Woreflint.A!cl
CynetMalicious (score: 99)
ALYacTrojan.GenericKD.38139233
MAXmalware (ai score=86)
MalwarebytesTrojan.BitCoinMiner.BAT
FortinetAdware/Miner
AVGOther:Malware-gen [Trj]

How to remove BAT/CoinMiner.ATM?

BAT/CoinMiner.ATM removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment