How to remove “Trojan:MSIL/CoinMiner!pz”?

The Trojan:MSIL/CoinMiner!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/CoinMiner!pz virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Trojan:MSIL/CoinMiner!pz?


File Info:
name: F0E3FE4ED3CB0C858B79.mlw
path: /opt/CAPEv2/storage/binaries/42fe5350866cf7c64433334e319860d06affe2428c4536316c21430aee5cfa66
crc32: E6E54370
md5: f0e3fe4ed3cb0c858b796077df07ed3a
sha1: 72b38a0006136faebf626c212d00556d241dd6c7
sha256: 42fe5350866cf7c64433334e319860d06affe2428c4536316c21430aee5cfa66
sha512: 61118bef2cea7d8fd814a3f5c8e5a5b10e38d36336839f400267ca4a143e5d082ac53f9fa5bdf8b9b6446a02d7edd35addd0dd83952e0d06e3ef5176852e2479
ssdeep: 6144:TvxMcv+gnSmENSuj/6/wL4ExxU46kvmXJZQ8vjK8/f8ZH50gpArH9q+huDGY4UTb:KcqE4rUamXJZXjK8XkiH9qXeU3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12E44BE9777C1CF50CBAC06BAC0E3AA2407B596472273E74938C403E69E137E99E46F46
sha3_384: 202dc5a38a2a6d02321a2ba969e02839262a564ec545e26771c066eda5e7b8794b819fe24b471eb2f94fedaf40d05384
ep_bytes: 
timestamp: 2080-10-20 12:10:15

Version Info:
0: [No Data]

Trojan:MSIL/CoinMiner!pz also known as:

DrWeb	Trojan.Encoder.37427
ClamAV	Win.Packed.Msilmamut-10001383-0
CAT-QuickHeal	Trojan.GenericFC.S30117201
Skyhigh	BehavesLike.Win32.Generic.dc
Malwarebytes	Generic.Malware.AI.DDS
CrowdStrike	win/malicious_confidence_100% (D)
ESET-NOD32	a variant of MSIL/Agent.XX
APEX	Malicious
Cynet	Malicious (score: 100)
Tencent	Trojan.MSIL.Agentb.ke
FireEye	Generic.mg.f0e3fe4ed3cb0c85
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.MSIL.aoidv
Google	Detected
Kingsoft	malware.kb.c.970
Xcitium	Heur.Corrupt.PE@1z141z3
Microsoft	Trojan:MSIL/CoinMiner!pz
Varist	W32/MSIL_Agent.GXL.gen!Eldorado
Rising	Worm.Agent!8.25 (TFE:dGZlOgydImrKtrcG1w)
Ikarus	Trojan.MSIL.Agent
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.XX!tr
Cybereason	malicious.006136

How to remove Trojan:MSIL/CoinMiner!pz?

Trojan:MSIL/CoinMiner!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X