Categories: Trojan

Trojan.Win64.Miner.pef removal tips

The Trojan.Win64.Miner.pef is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win64.Miner.pef virus can do?

Communicates with IPs located across a large number of unique countries
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
Multiple direct IP connections
Creates an excessive number of UDP connection attempts to external IP addresses
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Deletes its original binary from disk
Installs itself for autorun at Windows startup
Installs itself for autorun at Windows startup

How to determine Trojan.Win64.Miner.pef?


File Info:
name: BC137A2CB68F8A832E6E.mlwpath: /opt/CAPEv2/storage/binaries/112eb4002eb203f69aa678275b4590e09c33b9228198b7f0fab16711d4797ee8crc32: B17BDCFFmd5: bc137a2cb68f8a832e6e26db83c25cdfsha1: e7c0d4fe78fe8e413ae5445b5d6245487c8aeedcsha256: 112eb4002eb203f69aa678275b4590e09c33b9228198b7f0fab16711d4797ee8sha512: 7c04fb0057f07312390fc302d6910f44335b67edb3488d4e11784ef786c1cde19bde1893321e9a9e0ce771e70110243e8d6f183d5bcff3588275165849e37632ssdeep: 98304:EmJm/tFE4+DaC++U7ldouVbwmvPVlmAqyrw6EFGIgBf/tDE1U7TBDYMxuiAMGCmY:EPtndoK/3VlmkUwjZfBDYMxuD54Xtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1EE8633A3EBA492B2CAD164B14467C737AC366B08B72085C7C7FD283118368D0D77AF65sha3_384: 632be8c87ba573aefe95d809250df03eb2d4784b679c926d699dfff366ae33cdc6517cb5303621ee56b0a66d58517781ep_bytes: 6808050000680000000068acb24500e8timestamp: 2020-05-20 10:06:32
Version Info:
ProductName: Microsoft? Windows? Operating SystemProductVersion: 10.1.17234.556FileDescription: Host Process for Windows ServicesLegalCopyright: ? Microsoft Corporation. All rights reserved.Translation: 0x0000 0x04b0

Trojan.Win64.Miner.pef also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.14921
FireEye	Generic.mg.bc137a2cb68f8a83
CAT-QuickHeal	Trojan.GenericPMF.S15920341
McAfee	GenericRXPC-ZJ!BC137A2CB68F
Malwarebytes	Malware.AI.498111797
Zillya	Trojan.Scar.Win32.137027
K7AntiVirus	Trojan ( 0055fd4b1 )
K7GW	Trojan ( 0055fd4b1 )
Cybereason	malicious.cb68f8
Cyren	W32/S-4e460bf2!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.ABMT
APEX	Malicious
Kaspersky	HEUR:Trojan.Win64.Miner.pef
BitDefender	Gen:Variant.Doina.14921
NANO-Antivirus	Trojan.Win32.Mlw.hwpwiv
Avast	Win32:TrojanX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10cf876c
Ad-Aware	Gen:Variant.Doina.14921
Emsisoft	Gen:Variant.Doina.14921 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Scar.rlw
eGambit	Unsafe.AI_Score_96%
Avira	HEUR/AGEN.1137863
Antiy-AVL	Trojan/Generic.ASMalwS.30AAAA0
Microsoft	Trojan:Win32/Miner.KA!MTB
GData	Gen:Variant.Doina.14921
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R346308
BitDefenderTheta	Gen:NN.ZexaF.34294.@x3@aC8hKtpi
ALYac	Gen:Variant.Doina.14921
MAX	malware (ai score=82)
VBA32	BScope.Trojan.MulDrop
Cylance	Unsafe
Rising	Trojan.CoinMiner!1.CF9A (CLASSIC)
Yandex	Trojan.Agent!OTGcyG/nmKQ
Ikarus	Trojan.Win32.Agent
Fortinet	W32/CoinMiner.ED58!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_60% (D)