About “Win32/CoinMiner.BQL” infection

The Win32/CoinMiner.BQL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/CoinMiner.BQL virus can do?

• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid

How to determine Win32/CoinMiner.BQL?

File Info:
name: 149688FDCB8B8556AE78.mlw
path: /opt/CAPEv2/storage/binaries/5879baa061b3ca045160042b24ca3515c5d49b242be36ee0c2f035adcf2f667d
crc32: 3C93867D
md5: 149688fdcb8b8556ae788ca83bb36526
sha1: 0830d22647d2e53a9e7938910ca0b52ba06585bf
sha256: 5879baa061b3ca045160042b24ca3515c5d49b242be36ee0c2f035adcf2f667d
sha512: 1fd9ecb23e1c6d174c16f539ac303d347ab8c5b3f0a4ef5582ce82dec52c37dc0dc156cdb1e4ea1981fb654f87bf9f2f3c57e454bf053898b8aaac9450117b9d
ssdeep: 768:yeMvtq5EQO50ss6mOY/XtO6QsS17ZyhFvQUJTTwFtUsDKyX8VWfzmyhMiG2HunKo:y3vtq5EQejMVywF4iSZGS8KVuNvAs
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A8737C53F5C154F2D0260ABCAC1E862AED3E7D272D2E29867BEE194CCE2F6405D1D193
sha3_384: ce7d5b201902e7121a93f9dc644e3d71a010679cc2c39e1054746f343ac1cb69e039be1f9239c4a5147b0100d3f9302c
ep_bytes: 558bec83c4f033c08945f0b8c8f84000
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Client Server Runtime Process
FileVersion: 6.3.9600.16384 (winblue_rtm.130821-1623)
InternalName: CSRSS.Exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: CSRSS.Exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.3.9600.16384
Translation: 0x0409 0x04b0

Win32/CoinMiner.BQL also known as:

How to remove Win32/CoinMiner.BQL?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.