Categories: Malware

Win32/CoinMiner.BOU removal guide

The Win32/CoinMiner.BOU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/CoinMiner.BOU virus can do?

Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Creates a hidden or system file
Checks the CPU name from registry, possibly for anti-virtualization
Attempts to modify proxy settings
Creates a copy of itself

Related domains:

iplogger.org

How to determine Win32/CoinMiner.BOU?


File Info:
crc32: 907C0BCBmd5: d9a81b63017b3272e76fe96fdc89a67ename: D9A81B63017B3272E76FE96FDC89A67E.mlwsha1: 8ca5d7ee26ff1d6ba8a7e1ae98ea93a6659685b1sha256: c8aa2998f2d8513be33f5f1f2fce42af46f30d6891df52ee789b47966e0063c1sha512: 361089bf173feb0cd4a9ce72f3379ff3f13d7e58a9e10f9f32f150cb72b674664d325ec6213f9f2636cea2531801d4b4106e29e0ce4a501d1a069305daa3395dssdeep: 24576:iAHnh+eWsN3skA4RV1Hom2KXMmHaMVTDajrr282T5:lh+ZkldoPK8YaM4/CHtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: (C) XqyEAIWSD2uaMio1nRtCeudA9XT29DrFAR6mOGuZeyRrvdp Technology Co. Ltd., All rights reserved.InternalName: wuapp.exeFileVersion: 9.5.7.5CompanyName: x420x430x441x448x438x440x435x43dx438x435 x440x435x434x430x43ax442x43ex440x430 x433x440x443x43fx43fx43ex432x43ex439 x43fx43ex43bx438x442x438x43ax438 x434x43bx44f x43fx43ex43bx438x442x438x43a x443x43fx440x430x432x43bx435x43dx438x44f x43fx440x438x43bx43ex436x435x43dx438x44fx43cx438Comments: xumhf3bQlXS1PTwlDHYp9V8KRpkHggki4vsrU6Q6x3BXe7qquc8xoX2arUwD6QCXKXmDXXoa5fx6OqlENqnpWeiXaG6c3ProductVersion: 9.5.7.5FileDescription: x420x430x441x448x438x440x435x43dx438x435 x440x435x434x430x43ax442x43ex440x430 x433x440x443x43fx43fx43ex432x43ex439 x43fx43ex43bx438x442x438x43ax438 x434x43bx44f x43fx43ex43bx438x442x438x43ax438 x430x443x434x438x442x430OriginalFilename: wuapp.exeTranslation: 0x0809 0x04b0

Win32/CoinMiner.BOU also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 700000111 )
Lionic	Hacktool.Win32.Gamehack.3!e
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Trojan.Heur.AutoIT.17lv0@aiOOqBmi
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Trojan:Script/CoinMiner.232f96c9
K7GW	Trojan ( 700000111 )
Cybereason	malicious.3017b3
Cyren	W32/Trojan.XXCZ-4841
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/CoinMiner.BOU
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Trojan.Heur.AutoIT.17lv0@aiOOqBmi
MicroWorld-eScan	Gen:Trojan.Heur.AutoIT.17lv0@aiOOqBmi
Tencent	Win32.Trojan.Coinminer.Wtnk
Ad-Aware	Gen:Trojan.Heur.AutoIT.17lv0@aiOOqBmi
Sophos	Mal/Generic-S
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.tc
FireEye	Generic.mg.d9a81b63017b3272
Emsisoft	Gen:Trojan.Heur.AutoIT.17lv0@aiOOqBmi (B)
Avira	HEUR/AGEN.1100133
eGambit	Unsafe.AI_Score_98%
Microsoft	VirTool:Win32/Ymacco.AAC8
GData	Gen:Trojan.Heur.AutoIT.17lv0@aiOOqBmi
McAfee	Artemis!D9A81B63017B
MAX	malware (ai score=89)
VBA32	Trojan.Wacatac
Malwarebytes	Trojan.BitCoinMiner.Generic
Panda	Trj/Genetic.gen
Rising	Trojan.Obfus/Autoit!1.BD86 (CLASSIC)
Ikarus	Trojan.Win32.Autoit
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Miner
AVG	Win32:Malware-gen
Paloalto	generic.ml