Trojan:Win64/CoinMiner!pz removal guide

The Trojan:Win64/CoinMiner!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win64/CoinMiner!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win64/CoinMiner!pz?


File Info:
name: 48AD05B8FA95E7DC7775.mlw
path: /opt/CAPEv2/storage/binaries/936d6e63566aeb6b5918416734920f58c3025a915afb68931641725108ed9ee7
crc32: 3FDFB537
md5: 48ad05b8fa95e7dc7775a4601609cb7c
sha1: 456c6eed74b503b36ab32aea6ab5f455c28fb919
sha256: 936d6e63566aeb6b5918416734920f58c3025a915afb68931641725108ed9ee7
sha512: b7dc75dfae861054e1042a8f34168a4556744ef699ddbf430b83d1ed706c4ff695a5a082291cf73daf91c05f43dd13af1067fcce2634818e889e4ca7b985c66b
ssdeep: 24576:vBWelxqsfNMNr79DsI/AZOqXyepGbsfEcuoevn:8F/A1B8cy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D825235A5D6E883BCB0A03BD256F0B8F32C01A448325F8D7F7C42E96CA6D996153735D
sha3_384: 5b2da5ae119b31f14810140981ffcf6c1009e32eed61b5051a9198181f41bf1d86ad3fd056184ec87ed5433f731b0c14
ep_bytes: 7a59766e70706c5661645848556b7258
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan:Win64/CoinMiner!pz also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Ulise.267041
FireEye	Generic.mg.48ad05b8fa95e7dc
Skyhigh	BehavesLike.Win32.Generic.dm
McAfee	Artemis!48AD05B8FA95
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Ulise.D41321
Symantec	Packed.Generic.551
Elastic	malicious (moderate confidence)
ClamAV	Win.Trojan.Banload-9853585-0
BitDefender	Gen:Variant.Ulise.267041
NANO-Antivirus	Trojan.Win32.Miner.jeccbt
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Emsisoft	Gen:Variant.Ulise.267041 (B)
DrWeb	Trojan.PWS.Banker1.30278
VIPRE	Gen:Variant.Ulise.267041
TrendMicro	TROJ_GEN.R03BC0DB824
Sophos	Troj/Miner-ABM
Ikarus	Trojan.Win64.CoinMiner
Google	Detected
Varist	W32/S-8f4e9221!Eldorado
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	malware.kb.a.994
Xcitium	TrojWare.Win32.TrojanDownloader.Banload.RES@8hfp75
Microsoft	Trojan:Win64/CoinMiner!pz
GData	Gen:Variant.Ulise.267041
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Banload.C3470781
Acronis	suspicious
VBA32	TrojanPSW.Banker
ALYac	Gen:Variant.Ulise.267041
TrendMicro-HouseCall	TROJ_GEN.R03BC0DB824
Rising	Trojan.Generic@AI.100 (RDML:Nae1LR+4n+ZaPBjIl4YqEg)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Banload.BD2A!tr

How to remove Trojan:Win64/CoinMiner!pz?

Trojan:Win64/CoinMiner!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X