What is "NSIS:CoinMiner-C [Trj]"?

The NSIS:CoinMiner-C [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What NSIS:CoinMiner-C [Trj] virus can do?

Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine NSIS:CoinMiner-C [Trj]?


File Info:
crc32: AC114A9E
md5: 148230b0c2ae92dc2d4a2f46b389e2ae
name: 148230B0C2AE92DC2D4A2F46B389E2AE.mlw
sha1: c027292580695ace51d7c37a5f0b44b1b1704a90
sha256: 5ed94a431206c0828dc360e2b3042558aba4594fca1c21fc587ace272b35b752
sha512: 8ca48a1361fb3306befed615e52dc1c3bf6144d9af54867350f788cb201bdf30b9dd8b019beea17b418474aeb8e7870358ca8ce819704d696ea6edc1ff2e9353
ssdeep: 3072:2LuXzXwYyr6DoocEy5punpDuMoPdChdGhMlOjs3api/YHpoy8kD2PCcioyu:2p9punVujYhAhNJpi/YHpoylzu
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
LegalCopyright: xa9 x41ax43ex440x43fx43ex440x430x446x438x44f x41cx430x439x43ax440x43ex441x43ex444x442. x412x441x435 x43fx440x430x432x430 x437x430x449x438x449x435x43dx44b.
InternalName: explorer
FileVersion: 6.00.2900.5512 (xpsp.080413-2105)
CompanyName: x41ax43ex440x43fx43ex440x430x446x438x44f x41cx430x439x43ax440x43ex441x43ex444x442
ProductName: x41ex43fx435x440x430x446x438x43ex43dx43dx430x44f x441x438x441x442x435x43cx430 Microsoftxae Windowsxae
ProductVersion: 6.00.2900.5512
FileDescription: x41fx440x43ex432x43ex434x43dx438x43a
OriginalFilename: EXPLORER.EXE
Translation: 0x0419 0x04b0

NSIS:CoinMiner-C [Trj] also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0052cd2a1 )
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Win32.HLLW.Autoruner2.34745
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.30549135
Cylance	Unsafe
Sangfor	Trojan.Win32.Generic.ky
CrowdStrike	win/malicious_confidence_70% (D)
K7GW	Trojan ( 0052cd2a1 )
Cybereason	malicious.0c2ae9
Symantec	Downloader
ESET-NOD32	NSIS/Injector.AAG
APEX	Malicious
Avast	NSIS:CoinMiner-C [Trj]
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKD.30549135
NANO-Antivirus	Trojan.Win32.Inject.fadtbh
MicroWorld-eScan	Trojan.GenericKD.30549135
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.GenericKD.30549135
Sophos	Mal/Generic-S
Comodo	Malware@#139o1ufkab4r3
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dh
FireEye	Trojan.GenericKD.30549135
Emsisoft	Trojan.GenericKD.30549135 (B)
Avira	HEUR/AGEN.1127501
Microsoft	Ransom:Win32/Cryakl.A
GData	Trojan.GenericKD.30549135
McAfee	Artemis!148230B0C2AE
Panda	Trj/CI.A
MaxSecure	Trojan.Malware.7388093.susgen
Fortinet	W32/Injector.XG!tr
AVG	NSIS:CoinMiner-C [Trj]
Paloalto	generic.ml

How to remove NSIS:CoinMiner-C [Trj]?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “NSIS:CoinMiner-C [Trj]”?