How to remove “Trojan:MSIL/CoinMiner!pz”?

The Trojan:MSIL/CoinMiner!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/CoinMiner!pz virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Trojan:MSIL/CoinMiner!pz?


File Info:
name: 9CDA0F69F63BA5FE639F.mlw
path: /opt/CAPEv2/storage/binaries/81269a588aee525202643264a4efb3813852ca112e549502339dfaf163392386
crc32: E05B2D6D
md5: 9cda0f69f63ba5fe639fbf1e8ba5bc7b
sha1: 5d0e6f062d9924d538e78e50e8a3cee550604fb1
sha256: 81269a588aee525202643264a4efb3813852ca112e549502339dfaf163392386
sha512: 0ab4ffaf9c178289e95f19727e363cf1e9502d93b16af4f45a7282fc55980384b2e80db54abaa9f9181d05dde7c67faf6e93457d40a4d878a9738ade27ed2165
ssdeep: 6144:avxMcv+gnSmENSuj/6/wL4ExxU46kvmXJZQ8vjK8/f8ZH50gpArH9q+huDGY4UO:rcqE4rUamXJZXjK8XkiH9qXeUO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10544BE6777D1CF50CBAC06BAC0E3AA2407B596472273E74938C403E69E137E99E4AF45
sha3_384: b0a34a3cb6df9febc23230586b8e54389796e3fe6aafedc9690c2dc2c4180f8dfc89545a9f00bf8d1d3adb3df30371cb
ep_bytes: 
timestamp: 2080-10-20 12:10:15

Version Info:
0: [No Data]

Trojan:MSIL/CoinMiner!pz also known as:

MicroWorld-eScan	Trojan.GenericKDZ.104278
FireEye	Generic.mg.9cda0f69f63ba5fe
CAT-QuickHeal	Trojan.GenericFC.S30117201
Skyhigh	BehavesLike.Win32.Generic.dc
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Trojan.GenericKDZ.104278
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.62d992
Arcabit	Trojan.Generic.D19756
ESET-NOD32	a variant of MSIL/Agent.XX
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Packed.Msilmamut-10001383-0
BitDefender	Trojan.GenericKDZ.104278
Tencent	Trojan.MSIL.Agentb.ke
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.Encoder.37427
Emsisoft	Trojan.GenericKDZ.104278 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.MSIL.aoidv
Varist	W32/MSIL_Agent.GXL.gen!Eldorado
MAX	malware (ai score=89)
Kingsoft	malware.kb.c.961
Xcitium	Heur.Corrupt.PE@1z141z3
Microsoft	Trojan:MSIL/CoinMiner!pz
GData	Trojan.GenericKDZ.104278
Google	Detected
ALYac	Trojan.GenericKDZ.104278
Rising	Malware.Obfus/MSIL@AI.87 (RDM.MSIL2:VM67Owj1YzAOjxFjs9SIyQ)
Ikarus	Trojan.MSIL.Agent
Fortinet	MSIL/Agent.XX!tr
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Trojan:MSIL/CoinMiner!pz?

Trojan:MSIL/CoinMiner!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X