Launcher.exe Trojan CoinMiner Analysis

Trojan CoinMiner

Updated on 2025-04-13 (1 month ago)

Online Virus Checker	v.1.0.213.174
DB Version:	2025-04-13 00:00:23

Trojan.Win32.CoinMiner.vb

CoinMiner is a type of malware that harnesses the victim's computer resources, primarily CPU and RAM, to engage in cryptocurrency mining, such as for Monero or Zcash. This malware establishes persistence by integrating an open-source mining tool into the system's startup routine without the user's consent. Advanced coin miners often employ techniques like timer configurations or CPU usage limits to operate discreetly and avoid detection.

File	Launcher.exe
Checked	2025-04-12 21:59:21
MD5	5f335a35ae024a0269ecb9cdec98c61c
SHA1	52d58f06db89f360a389f5b92c8490c748e6d310
SHA256	205c04a83a4294a06fb87d6037df1d0fbda876493269fbb58a8d697242b695cc
SHA512	f5e072f3638043484c6b7681487780842c3f43fecc7ea6db95edc869f7e076a80fd54745184c814b03724b997a3dd76a8209811853fac9d9b1733ab3299af2e1
Imphash	5877688b4859ffd051f6be3b8e0cd533
File Size	101888 bytes

Trojan.Win32.CoinMiner.vb Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.CoinMiner.vb without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

CompanyName	ORiGiNS
LegalCopyright	ORiGiNS
Translation	0x0000 0x04e4

Portable Executable Info

	59566656572c3245c6def7091e42181c b2764f6b84f036fb6164289b7fec6f72 5830b0fc74b4e470
Image Base:	0x00400000
Entry Point:	0x00401000
Compilation:	2018-02-01 20:18:00
Checksum:	0x00000000 (Actual: 0x00023d72)
OS Version:	4.0
PEiD:	PE32 executable (GUI) Intel 80386, for MS Windows
Sign:	No valid SignedData structure was found.
Sections:	5
Imports:	MSVCRT, KERNEL32, USER32, GDI32, COMCTL32, SHELL32, WINMM, OLE32, SHLWAPI,
Exports:	0
Resources:	13

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.code	0x00001000	0x000037f0	0x00003800	d8af5494a902a4276e7a118e639a9058	5.61
.text	0x00005000	0x0000cfa2	0x0000d000	3d44adf99d47c66df6ed2c6ecde44714	6.59
.rdata	0x00012000	0x000033a0	0x00003400	e4a2346f39e8c4c981487f3b09547faf	7.11
.data	0x00016000	0x00001724	0x00001200	8f719b08a0b5eefbb620b58b6de3bef1	4.94
.rsrc	0x00018000	0x00003b00	0x00003c00	59e61cb39d9f99dfc9bbd725fa366703	4.77

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

5 4 3 2 1