Risk

RiskTool.Win32.BitCoinMiner.hzfm malicious file

Malware Removal

The RiskTool.Win32.BitCoinMiner.hzfm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What RiskTool.Win32.BitCoinMiner.hzfm virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • Starts servers listening on 0.0.0.0:13333
  • Enumerates running processes
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Attempts to access Bitcoin/ALTCoin wallets

How to determine RiskTool.Win32.BitCoinMiner.hzfm?


File Info:

name: 20F8070A4F2A33F74B65.mlw
path: /opt/CAPEv2/storage/binaries/a7e3617a001af9cabf4a73c2d121697200081d2281f18b2f385023c6c753f069
crc32: 00D21741
md5: 20f8070a4f2a33f74b65eed706c8f95c
sha1: 22e503ed4372f4039a43037b476020464faa5c9c
sha256: a7e3617a001af9cabf4a73c2d121697200081d2281f18b2f385023c6c753f069
sha512: fbde171e3ca613b1fe9f33acfd81803c21f1588e40e00c4172bad71d326dfa5a7a3766fdc8590420281480cbcb131985ef1859ccbacebdb38112fe852d570236
ssdeep: 196608:dCE7HyTgh3J84ufeVxcbYyTg7VO8SV7GWSQUwQGEU3l6NtiPOVq8oDDCrpTlFCQx:MM58kQbSQ5QGEOA2F2ZFCIG+
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1BC562915E247C0F5DC6705B16607FBBF4A207A3580208CAAFA84DE59EB73DE6761E312
sha3_384: dfa875eda984f3bea503f919ebd3be59c4d376289702ee7ba48f2641f596e58ea61b01675e4a6e7838922801e6ba8818
ep_bytes: 5589e583ec146a01ff15e808a100e8dd
timestamp: 2013-04-16 16:50:03

Version Info:

0: [No Data]

RiskTool.Win32.BitCoinMiner.hzfm also known as:

LionicRiskware.Win32.BitCoinMiner.1!c
CylanceUnsafe
SangforCoinMiner.Win32.Agent.hzfm
AlibabaRiskWare:Win32/Miners.1494b226
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/CoinMiner.BJ potentially unwanted
Paloaltogeneric.ml
Kasperskynot-a-virus:RiskTool.Win32.BitCoinMiner.hzfm
NANO-AntivirusRiskware.Win32.BitCoinMiner.fccnye
AvastWin32:Malware-gen
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.BadFile.vh
JiangminRiskTool.BitCoinMiner.izh
WebrootW32.Adware.Gen
Antiy-AVLTrojan/Generic.ASMalwS.1DA1525
GridinsoftRansom.Win32.Miner.sa
MicrosoftPUA:Win32/Presenoker
McAfeeArtemis!20F8070A4F2A
RisingMalware.Heuristic!ET#82% (C64:YzY0OkJFiVmULP6X)
YandexTrojan.GenAsa!V2rRTmKjYaM
FortinetRiskware/CoinMiner
AVGWin32:Malware-gen

How to remove RiskTool.Win32.BitCoinMiner.hzfm?

RiskTool.Win32.BitCoinMiner.hzfm removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment