Win32/CoinMiner.BGU (file analysis)

The Win32/CoinMiner.BGU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/CoinMiner.BGU virus can do?

The binary likely contains encrypted or compressed data.

How to determine Win32/CoinMiner.BGU?


File Info:
crc32: 608BF114
md5: 1c7c9d548978f79fe1239cdb3ebf524d
name: 1C7C9D548978F79FE1239CDB3EBF524D.mlw
sha1: fb5cec9f6d7dc3d329ae8fa2176b2bdaeb15e4dd
sha256: b9abdb22ff6b1f23f17c0aa08ee876c52ccd40a9c02e6534d52ef385b3e55c3a
sha512: d947c013eba5c653c029a7f4a701f8ad41849ac68f45dd8a989730584988f06bc8634c2e59c837fda8a762aa6959c56c417580c5bc97f56d48e62b57890d377e
ssdeep: 49152:eG00SSgCmP/ZwYj48a0H+uyJEDAMnqAvZrWK5rUO75FE/Ws2:eJnZwQeuyJEUgLxrWK5I45FT
type: PE32+ executable (GUI) x86-64, for MS Windows

Version Info:
LegalCopyright: 2017 (c) Realtek Semiconductor.  All rights reserved.
InternalName: RtHDVBgProc.exe
FileVersion: 1, 0, 0, 281
CompanyName: Realtek Semiconductor
ProductName: Realtek HD Audio
ProductVersion: 1, 0, 0, 281
FileDescription: Realtek HD Audio
OriginalFilename: taskhostw.exe
Translation: 0x0409 0x04e4

Win32/CoinMiner.BGU also known as:

K7AntiVirus	Trojan ( 0055234b1 )
Lionic	Trojan.Win32.BitCoinMiner.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.AutoIt.966
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.41636713
CrowdStrike	win/malicious_confidence_80% (D)
Alibaba	Trojan:Win32/CoinMiner.ali1002002
K7GW	Trojan ( 0055234b1 )
Cybereason	malicious.48978f
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/CoinMiner.BGU
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Autoit-6867844-0
Kaspersky	Trojan.Win32.Autoit.acbae
BitDefender	Trojan.GenericKD.41636713
NANO-Antivirus	Trojan.Script.Miner.hlniuu
MicroWorld-eScan	Trojan.GenericKD.41636713
Tencent	Win32.Trojan.Bitcoinminer.Eaee
Ad-Aware	Trojan.GenericKD.41636713
Sophos	Mal/Generic-S
Comodo	Malware@#y63guoxqz5x4
VIPRE	Adware.InstallCore
TrendMicro	TROJ_GEN.R002C0DFO21
McAfee-GW-Edition	BehavesLike.Win64.Dropper.th
FireEye	Generic.mg.1c7c9d548978f79f
Emsisoft	Trojan.GenericKD.41636713 (B)
Webroot	W32.Trojan.Gen
Avira	PUA/AD.BitcoinMiner.asf
Microsoft	Trojan:Win32/Occamy.C
GData	Trojan.GenericKD.41636713
AhnLab-V3	Trojan/Win64.Miner.R260334
McAfee	Generic Trojan.kn
MAX	malware (ai score=100)
Malwarebytes	Trojan.BitCoinMiner
TrendMicro-HouseCall	TROJ_GEN.R002C0DFO21
Rising	Trojan.Agent/Autoit!1.CADF (CLASSIC)
Ikarus	Trojan.SuspectCRC
MaxSecure	Trojan.Malware.4917374.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Win32/CoinMiner.BGU?

Win32/CoinMiner.BGU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X