MarvelousDesigner12_Personal_x64.exe Trojan CoinMiner Analysis

Trojan CoinMiner

Updated on 2024-09-12 (25 days ago)

Online Virus Checker	v.1.0.187.174
DB Version:	2024-09-12 23:00:38

Trojan.Win64.CoinMiner.cl

CoinMiner is a type of malware that harnesses the victim's computer resources, primarily CPU and RAM, to engage in cryptocurrency mining, such as for Monero or Zcash. This malware establishes persistence by integrating an open-source mining tool into the system's startup routine without the user's consent. Advanced coin miners often employ techniques like timer configurations or CPU usage limits to operate discreetly and avoid detection.

File	MarvelousDesigner12_Personal_x64.exe
Checked	2024-09-12 20:58:49
MD5	b8a9ba10aad52e79d07d95e4912be9cb
SHA1	593ccd25484688bf395d5dadaf19102c770d9367
SHA256	925431d9ad6dde0970110c701b45d78ba2ef5806cd56eb8b2014efc5bb73ee5b
SHA512	72147568d9cdc16430b0aae483af2ce332a647bc62915ce5761e1c110e0996a834c9bb9dbe47e99f4d43557dba6e2bce3a6498e85a1da2ea381d98d2e0b241fc
Imphash	a589ba7bbee6e12ef05d757f0a9f4ead
File Size	42080256 bytes

Trojan.Win64.CoinMiner.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.CoinMiner.cl without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

FileVersion	7, 1, 143, 41692
ProductVersion	7, 1, 143, 41692
ProductName	Marvelous Designer Personal
LegalCopyright	Copyright 2022 CLO Virtual Fashion Inc. All rights reserved.
Translation	0x0412 0x04b0

Portable Executable Info

	cfd8046d4ce61aa494c11f056d257c32 6e52000f98ea8404a09e57eb6e4b6e0a 70fc6d330f2bd0f0
Image Base:	0x140000000
Entry Point:	0x14d0be9c7
Compilation:	2022-12-06 07:15:59
Checksum:	0x028258b2 (Actual: 0x028258b2)
OS Version:	6.0
PDB Path:	C:\Users\admin\Documents\BuildAgent\work\477ea84496986ea8\Marvelous\Distribution\Release_MDX_Personal\x64\MarvelousDesigner12_Personal_x64.pdb
PEiD:	PE32+ executable (GUI) x86-64, for MS Windows
Sign:	The PE file does not contain a certificate table.
Sections:	15
Imports:	OPENGL32, GLU32, ftgl_x64, libssl-1_1-x64, libcrypto-1_1-x64, WS2_32, WLDAP32, Qt5WebEngine, Qt5WebEngineWidgets, Alembic, substance_linker, substance_ogl3_blend, collada-dom2, python37, libfbxsdk, opencv_core450, opencv_imgcodecs450, opencv_imgproc450, opencv_videoio450, Qt5Core, Qt5Gui, Qt5Network, Qt5OpenGL, Qt5Xml, Qt5Svg, Qt5Widgets,
Exports:	1
Resources:	4

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.textbss	0x00001000	0x028fb0b7	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.text	0x028fd000	0x053af8e5	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.rdata	0x07cad000	0x04007ab5	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.data	0x0bcb5000	0x003190d9	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.pdata	0x0bfcf000	0x00258120	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.idata	0x0c228000	0x00054602	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.msvcjmc	0x0c27d000	0x00000101	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.tls	0x0c27e000	0x0000d743	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.nv_fatb	0x0c28c000	0x00937d0c	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.nvFatBi	0x0cbc4000	0x0000011c	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.00cfg	0x0cbc5000	0x0000011b	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
_RDATA	0x0cbc6000	0x0000c35a	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.vmp0	0x0cbd3000	0x0014a906	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.vmp1	0x0cd1e000	0x027e53fc	0x027e5400	73691df470464423968df60c953e0b68	7.99
.rsrc	0x0f504000	0x0003bd4d	0x0003be00	a0adf2c78dce3e7c1bcb107d165cffd9	4.43