Categories: Trojan

How to remove “Trojan-PSW.Win32.Coins.voh”?

The Trojan-PSW.Win32.Coins.voh is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-PSW.Win32.Coins.voh virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
Expresses interest in specific running processes
The binary likely contains encrypted or compressed data.
Checks for the presence of known windows from debuggers and forensic tools
Steals private information from local Internet browsers
The following process appear to have been packed with Themida: 2.exe
Collects information about installed applications
Attempts to identify installed AV products by installation directory
Checks for the presence of known devices from debuggers and forensic tools
Detects the presence of Wine emulator via registry key
Checks the version of Bios, possibly for anti-virtualization
Checks the CPU name from registry, possibly for anti-virtualization
Detects VirtualBox through the presence of a registry key
Attempts to access Bitcoin/ALTCoin wallets
Anomalous binary characteristics

Related domains:

ip-api.com

nife02.info

How to determine Trojan-PSW.Win32.Coins.voh?


File Info:
crc32: 60AFB4CDmd5: 43520210c895cf78273113db5617691dname: 2.exesha1: b605cd69d58f81fa521648e6e470adfba076c810sha256: 50b9d3cf8e24e1f87e1ca87ae2d38668b3ae0772770bdc670ae9127894b53b33sha512: 9d072bb4d2ba3f76600e2580004ec9136e2f68039c0d314daccb99747b8362121e08942a167971070da7a8fa696ede8b176637b503119fd3d752ca138453eeb8ssdeep: 49152:HnZywONeDaCDo9qLFe4TWnwLrVUIPvUUDfFPTWLtzFFZHyMrip0g5vD:HnZywaS+IeqLCIHJ+FcF0type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Trojan-PSW.Win32.Coins.voh also known as:

Bkav	W32.HfsAutoB.
MicroWorld-eScan	Trojan.GenericKD.42769497
FireEye	Generic.mg.43520210c895cf78
Qihoo-360	Win32/Trojan.Dropper.838
McAfee	Artemis!43520210C895
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0040f4ef1 )
BitDefender	Trojan.GenericKD.42769497
K7GW	Trojan ( 0040f4ef1 )
Cybereason	malicious.9d58f8
TrendMicro	TROJ_GEN.R011C0WC120
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Trojan-gen
GData	Trojan.GenericKD.42769497
Kaspersky	Trojan-PSW.Win32.Coins.voh
Alibaba	TrojanPSW:Win32/Coins.6b3da1b5
NANO-Antivirus	Trojan.Win32.Coins.hdkgdf
ViRobot	Trojan.Win32.Z.Themida.2126336
AegisLab	Trojan.Win32.Generic.4!c
Rising	Stealer.Cryptbot!8.1116F (CLOUD)
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1045048
DrWeb	Trojan.Siggen9.16154
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.vc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.42769497 (B)
Ikarus	Trojan.Win32.Themida
Cyren	W32/Trojan.OHMC-3613
Jiangmin	Trojan.Generic.elxnj
Avira	HEUR/AGEN.1045048
Antiy-AVL	Trojan[PSW]/Win32.Coins
Arcabit	Trojan.Generic.D28C9C59
ZoneAlarm	Trojan-PSW.Win32.Coins.voh
Microsoft	Trojan:Win32/Occamy.C
Acronis	suspicious
VBA32	TScope.Malware-Cryptor.SB
ALYac	Trojan.GenericKD.33437423
MAX	malware (ai score=85)
Ad-Aware	Trojan.GenericKD.42769497
Malwarebytes	Spyware.PasswordStealer.Themida
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Packed.Themida.HIQ
TrendMicro-HouseCall	TROJ_GEN.R011C0WC120
Tencent	Win32.Trojan-qqpass.Qqrob.Pavi
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Themida.HIQ!tr
BitDefenderTheta	Gen:NN.ZexaF.34096.bAWaaW1FECei
AVG	Win32:Trojan-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen