MSIL/CoinMiner.BPE removal tips

The MSIL/CoinMiner.BPE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/CoinMiner.BPE virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
Anomalous .NET characteristics
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine MSIL/CoinMiner.BPE?


File Info:
name: 4DCAFDE366724E3A9048.mlw
path: /opt/CAPEv2/storage/binaries/0c29bc23872aa8a7d4cfe407cc662d6c5fe569d72170962bf7fbb3900732b2d1
crc32: F770A3B3
md5: 4dcafde366724e3a9048e2c55dabb886
sha1: d788b0bb71af72ab5a413052cb1f0bef936481ed
sha256: 0c29bc23872aa8a7d4cfe407cc662d6c5fe569d72170962bf7fbb3900732b2d1
sha512: c0bfb3f8e2770d47901c9829c5bf8cc6d59f73fd1f5574b82bd641fc8b27dfb16d63460aeb26c5a5159861a3fee372a06160e11a1b1a72d9669bc9d1af1c44a1
ssdeep: 96:Sl6piz7SH5BKJqbZlmdKUV9xjVX5ZXxL8xxQxxmSCl3LczNt:oz7c0JEZwdKUVLxX5ZBLwCxaJm
type: PE32+ executable (console) x86-64, for MS Windows
tlsh: T19EF1E904B3FD8505F5FE8F3424F557A05679FE872FA3E64E1C8540491D34B8489A27B2
sha3_384: bc074cc0c0a1ff4d8504da82b0d6c224c50dd89e9808fc9d9c6f52a34e49e81670544a37cbaa06dec15cfde564cfb3e7
ep_bytes: 4d5a90000300000004000000ffff0000
timestamp: 2021-11-22 10:33:45

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: sys32-checker.exe
LegalCopyright:  
OriginalFilename: sys32-checker.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/CoinMiner.BPE also known as:

Lionic	Trojan.Win32.Sdum.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.38092035
FireEye	Generic.mg.4dcafde366724e3a
CAT-QuickHeal	Trojan.Sdum
McAfee	Artemis!4DCAFDE36672
Zillya	Trojan.CoinMiner.Win32.40745
Alibaba	Trojan:MSIL/CoinMiner.ee4354b4
Cyren	W64/CoinMiner.ET.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/CoinMiner.BPE
TrendMicro-HouseCall	TROJ_GEN.R002C0WKP21
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Trojan.GenericKD.38092035
Avast	Win64:CoinminerX-gen [Trj]
Ad-Aware	Trojan.GenericKD.38092035
Emsisoft	Trojan.GenericKD.38092035 (B)
TrendMicro	TROJ_GEN.R002C0WKP21
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
GData	Win64.Trojan.Agent.QNXFDZ
Avira	TR/CoinMiner.xadrx
MAX	malware (ai score=81)
Gridinsoft	Ransom.Win64.Gen.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 99)
VBA32	Trojan.Sdum
ALYac	Trojan.GenericKD.38092035
Ikarus	Trojan.MSIL.CoinMiner
Fortinet	Adware/Miner
AVG	Win64:CoinminerX-gen [Trj]

How to remove MSIL/CoinMiner.BPE?

MSIL/CoinMiner.BPE removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X