Trojan:MSIL/CoinMiner!pz removal guide

The Trojan:MSIL/CoinMiner!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/CoinMiner!pz virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Trojan:MSIL/CoinMiner!pz?


File Info:
name: 8DB3EED872EA2A20F9CA.mlw
path: /opt/CAPEv2/storage/binaries/f7e0f50840207bfb6d2dcb0f44888989067a6cac6bc96beec3058955ff738558
crc32: EC3C76BD
md5: 8db3eed872ea2a20f9ca3117eaf27a52
sha1: 6b7fe04dfcf1a79200108713f54ee013103dc384
sha256: f7e0f50840207bfb6d2dcb0f44888989067a6cac6bc96beec3058955ff738558
sha512: 5d18575cb6edb32ec7bfcff419c0d44ec55229e133fa9b7e9bca2742674330635bbbc59b6792ed7c442dfe219cf45de5189c8d12235e0bfa5604d2cc5afaf220
ssdeep: 6144:4lrkFt1JVO+GO91K1cAHqpqFarKSQNzhwUvI8rtPI2sKRXu:nJVt1918SuzpvriSe
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16444CF6B73C28F92C79D2BB6C4D3863007F1A5973273EB05298413DA9D423E4DE5AB85
sha3_384: e822338c43a00fe43753db83970bc19c747bae4b1d8666fe4435b427b18f2de9964d67e4b6c1ffddaee064be126ab927
ep_bytes: 
timestamp: 2105-05-31 05:12:31

Version Info:
0: [No Data]

Trojan:MSIL/CoinMiner!pz also known as:

Skyhigh	BehavesLike.Win32.Generic.dc
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
ESET-NOD32	a variant of MSIL/Agent.XX
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Packed.Msilmamut-10002308-0
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.MulDrop21.54333
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.8db3eed872ea2a20
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.MSIL.aoiow
Varist	W32/MSIL_Agent.GXL.gen!Eldorado
Xcitium	Heur.Corrupt.PE@1z141z3
Microsoft	Trojan:MSIL/CoinMiner!pz
Google	Detected
Rising	Worm.Agent!8.25 (TFE:dGZlOgzVWLAndPMmZw)
Ikarus	Trojan.MSIL.Agent
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.XX!tr
Cybereason	malicious.dfcf1a

How to remove Trojan:MSIL/CoinMiner!pz?

Trojan:MSIL/CoinMiner!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X