Categories: Malware

How to remove “BAT/CoinMiner.ATM”?

The BAT/CoinMiner.ATM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BAT/CoinMiner.ATM virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Guard pages use detected – possible anti-debugging.
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
A cryptomining command was executed
Binary compilation timestomping detected
Uses suspicious command line tools or Windows utilities

How to determine BAT/CoinMiner.ATM?


File Info:
name: 98C7C4F2C32400587AE5.mlwpath: /opt/CAPEv2/storage/binaries/d5623861ab4f90f550bc399c438cf5917416c0dacd5e487486b5192fec2a7231crc32: 59E602E3md5: 98c7c4f2c32400587ae5afd97b9a452asha1: a9d6e64200d9ec6491deafcba71e7bba3be49f97sha256: d5623861ab4f90f550bc399c438cf5917416c0dacd5e487486b5192fec2a7231sha512: cf8ea95ab63b3f8f45c3900f8402676258c0f477ece6dda5c5172dda9c2f45b842a4a2170bdf2c6da0ffc97452729819357146567f4fc9c8efb7d309b137b602ssdeep: 3072:J18c7+01i5GWp1icKAArDZz4N9GhbkrNEk1IhMP:r8c7+fp0yN90QECtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D0E39E53B7D88033D9B52BB058F613C30B36BCA15D78836B2785A95E0DB3684A53277Bsha3_384: 5a24570449efe0e0fa85ffc818e1062aefad87306078d25529e5655613508d974e437de0cc1cb646e2eafd7c65f50b81ep_bytes: e88e060000e9000000006a5c68007340timestamp: 2100-01-12 05:50:52
Version Info:
CompanyName: Microsoft CorporationFileDescription: Win32 Cabinet Self-Extractor                                           FileVersion: 11.00.17134.1 (WinBuild.160101.0800)InternalName: Wextract                LegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: WEXTRACT.EXE            .MUIProductName: Internet ExplorerProductVersion: 11.00.17134.1Translation: 0x0409 0x04b0

BAT/CoinMiner.ATM also known as:

MicroWorld-eScan	Trojan.GenericKD.38139233
FireEye	Generic.mg.98c7c4f2c3240058
McAfee	RDN/Generic.grp
Cylance	Unsafe
K7AntiVirus	Trojan ( 00581e2f1 )
K7GW	Trojan ( 00581e2f1 )
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	BAT/CoinMiner.ATM
Kaspersky	HEUR:Trojan.BAT.Miner.gen
BitDefender	Trojan.GenericKD.38139233
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
Avast	Other:Malware-gen [Trj]
Tencent	Bat.Trojan.Miner.Hwct
Ad-Aware	Trojan.GenericKD.38139233
McAfee-GW-Edition	RDN/Generic.grp
Emsisoft	Trojan.GenericKD.38139233 (B)
GData	Trojan.GenericKD.38139233
Avira	BAT/CoinMiner.AR
Microsoft	Trojan:Win32/Woreflint.A!cl
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.38139233
MAX	malware (ai score=86)
Malwarebytes	Trojan.BitCoinMiner.BAT
Fortinet	Adware/Miner
AVG	Other:Malware-gen [Trj]