Trojan:Win64/Coinminer.RB!MTB information

The Trojan:Win64/Coinminer.RB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win64/Coinminer.RB!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win64/Coinminer.RB!MTB?


File Info:
name: F8237724503FD22CEEFE.mlw
path: /opt/CAPEv2/storage/binaries/0f2be04e10720272499e770a64e5a4a04cad5a4474e68cd62ed559f0f6304dba
crc32: 4217D18C
md5: f8237724503fd22ceefe267b151d2dd5
sha1: 78c95a5cee456c55b64585692f65794f445115b3
sha256: 0f2be04e10720272499e770a64e5a4a04cad5a4474e68cd62ed559f0f6304dba
sha512: 907647dc578a6db18c6f172f64fb67d2196d2b0901161b7a53196cbc764a1a8904d77202148499a1cd95cd2ae687c865143c6e1320bfe887cd77aa3d72c8ef29
ssdeep: 49152:7EAh02jxrhuGdh2VlVMxo4cbgDcKdBHclBlOQlb5ajm8OOMx6u24ny:7csrhP+Vgo4MgwKdO7FlaCkZu24
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T176C5331E7355B0ECE814863B66E4FE5B495ADD230B26B1C7EFF0D84A5AF12CAD835810
sha3_384: 0dc4402110f58312e0012b11e720a4c234ce11d6fec114ba9f173e143293378a2de32c2528c7315c559c2380dfb19aba
ep_bytes: 4883ec28488b05d54e0000c700010000
timestamp: 2023-12-23 11:04:48

Version Info:
0: [No Data]

Trojan:Win64/Coinminer.RB!MTB also known as:

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
MicroWorld-eScan	Gen:Variant.Tedy.488309
FireEye	Generic.mg.f8237724503fd22c
Skyhigh	BehavesLike.Win64.Generic.vh
ALYac	Gen:Variant.Tedy.488309
Cylance	unsafe
Sangfor	Trojan.Win64.Kryptik.V8ds
K7AntiVirus	Trojan ( 005af85d1 )
Alibaba	Trojan:Win64/Coinminer.36de29c3
K7GW	Trojan ( 005af85d1 )
CrowdStrike	win/malicious_confidence_90% (D)
Arcabit	Trojan.Tedy.D77375
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win64/Kryptik.EDF
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Tedy.488309
Avast	Win64:Evo-gen [Trj]
Tencent	Win32.Trojan.Agent.Edhl
Ad-Aware	Gen:Variant.Tedy.488309
Sophos	Mal/Generic-S
VIPRE	Gen:Variant.Tedy.488309
Emsisoft	Gen:Variant.Tedy.488309 (B)
Ikarus	Trojan.Win64.Krypt
Antiy-AVL	Trojan/Win64.GenKryptik
Microsoft	Trojan:Win64/Coinminer.RB!MTB
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
GData	Gen:Variant.Tedy.488309
Varist	W64/Agent.HWR.gen!Eldorado
AhnLab-V3	Dropper/Win.DropperX-gen.R622355
McAfee	Artemis!F8237724503F
MAX	malware (ai score=88)
Malwarebytes	Trojan.Downloader
Rising	Trojan.Agent!8.B1E (TFE:5:Hq24sHNUm4U)
Fortinet	W64/GenKryptik.GQCB!tr
AVG	Win64:Evo-gen [Trj]
Cybereason	malicious.cee456
DeepInstinct	MALICIOUS

How to remove Trojan:Win64/Coinminer.RB!MTB?

Trojan:Win64/Coinminer.RB!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X