Trojan:MSIL/CoinMiner!pz (file analysis)

The Trojan:MSIL/CoinMiner!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/CoinMiner!pz virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Trojan:MSIL/CoinMiner!pz?


File Info:
name: A51E0CAF88692123B681.mlw
path: /opt/CAPEv2/storage/binaries/bfac5b854ef8bda9a893ba63b7e058d81be4bc01542afef201d7c259e1a3e2a6
crc32: 2A0FE18F
md5: a51e0caf88692123b6817ed6f5dc45ce
sha1: c3d2afca39f23fc258480eea7124aa39d0c27078
sha256: bfac5b854ef8bda9a893ba63b7e058d81be4bc01542afef201d7c259e1a3e2a6
sha512: 6df67438149ab41ea9ba0b480bfa0f919dfbd2191bcfcc600e9c769b73fe271a954a7f8e767c398a369d88528ab90a6ac71bf89593bb3b3b5ea682bacb441966
ssdeep: 6144:5lrkFt1JVO+GO91K1cAHqpqFarKSQNzhwUvI8rtPI2sKRX0U:iJVt1918SuzpvriSp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12944CF6B73C28F92C79D2AB6C4E3463007F5A4973273EB05398413DA9D423E4DE5AB85
sha3_384: d9df281e6d2b122de05a514e31d496c43e0d1adfdfda12d1b451c93fff145cc73aef1e951bf223aaa2b34ff55c6064b8
ep_bytes: 
timestamp: 2105-05-31 05:12:31

Version Info:
0: [No Data]

Trojan:MSIL/CoinMiner!pz also known as:

FireEye	Generic.mg.a51e0caf88692123
CAT-QuickHeal	Trojan.GenericFC.S30222860
Skyhigh	BehavesLike.Win32.Generic.dc
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
ESET-NOD32	a variant of MSIL/Agent.XX
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Packed.Msilmamut-10002308-0
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.MulDrop21.54333
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.MSIL.aoiow
Varist	W32/MSIL_Agent.GXL.gen!Eldorado
Xcitium	Heur.Corrupt.PE@1z141z3
Microsoft	Trojan:MSIL/CoinMiner!pz
Google	Detected
Rising	Malware.Obfus/MSIL@AI.86 (RDM.MSIL2:KEGjXlk8aPfpsZCaRIPegA)
Ikarus	Trojan.MSIL.Agent
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.XX!tr
Cybereason	malicious.a39f23

How to remove Trojan:MSIL/CoinMiner!pz?

Trojan:MSIL/CoinMiner!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X