Categories: Malware

What is “NSIS:CoinMiner-C [Trj]”?

The NSIS:CoinMiner-C [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What NSIS:CoinMiner-C [Trj] virus can do?

Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine NSIS:CoinMiner-C [Trj]?


File Info:
crc32: AC114A9Emd5: 148230b0c2ae92dc2d4a2f46b389e2aename: 148230B0C2AE92DC2D4A2F46B389E2AE.mlwsha1: c027292580695ace51d7c37a5f0b44b1b1704a90sha256: 5ed94a431206c0828dc360e2b3042558aba4594fca1c21fc587ace272b35b752sha512: 8ca48a1361fb3306befed615e52dc1c3bf6144d9af54867350f788cb201bdf30b9dd8b019beea17b418474aeb8e7870358ca8ce819704d696ea6edc1ff2e9353ssdeep: 3072:2LuXzXwYyr6DoocEy5punpDuMoPdChdGhMlOjs3api/YHpoy8kD2PCcioyu:2p9punVujYhAhNJpi/YHpoylzutype: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Version Info:
LegalCopyright: xa9 x41ax43ex440x43fx43ex440x430x446x438x44f x41cx430x439x43ax440x43ex441x43ex444x442. x412x441x435 x43fx440x430x432x430 x437x430x449x438x449x435x43dx44b.InternalName: explorerFileVersion: 6.00.2900.5512 (xpsp.080413-2105)CompanyName: x41ax43ex440x43fx43ex440x430x446x438x44f x41cx430x439x43ax440x43ex441x43ex444x442ProductName: x41ex43fx435x440x430x446x438x43ex43dx43dx430x44f x441x438x441x442x435x43cx430 Microsoftxae WindowsxaeProductVersion: 6.00.2900.5512FileDescription: x41fx440x43ex432x43ex434x43dx438x43aOriginalFilename: EXPLORER.EXETranslation: 0x0419 0x04b0

NSIS:CoinMiner-C [Trj] also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0052cd2a1 )
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Win32.HLLW.Autoruner2.34745
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.30549135
Cylance	Unsafe
Sangfor	Trojan.Win32.Generic.ky
CrowdStrike	win/malicious_confidence_70% (D)
K7GW	Trojan ( 0052cd2a1 )
Cybereason	malicious.0c2ae9
Symantec	Downloader
ESET-NOD32	NSIS/Injector.AAG
APEX	Malicious
Avast	NSIS:CoinMiner-C [Trj]
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKD.30549135
NANO-Antivirus	Trojan.Win32.Inject.fadtbh
MicroWorld-eScan	Trojan.GenericKD.30549135
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.GenericKD.30549135
Sophos	Mal/Generic-S
Comodo	Malware@#139o1ufkab4r3
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dh
FireEye	Trojan.GenericKD.30549135
Emsisoft	Trojan.GenericKD.30549135 (B)
Avira	HEUR/AGEN.1127501
Microsoft	Ransom:Win32/Cryakl.A
GData	Trojan.GenericKD.30549135
McAfee	Artemis!148230B0C2AE
Panda	Trj/CI.A
MaxSecure	Trojan.Malware.7388093.susgen
Fortinet	W32/Injector.XG!tr
AVG	NSIS:CoinMiner-C [Trj]
Paloalto	generic.ml