FinalShell_license.exe Trojan CoinMiner Analysis

Trojan CoinMiner

Updated on 2024-10-24 (1 month ago)

Online Virus Checker	v.1.0.194.174
DB Version:	2024-10-24 11:00:27

Trojan.Win64.CoinMiner.oa!s1

CoinMiner is a type of malware that harnesses the victim's computer resources, primarily CPU and RAM, to engage in cryptocurrency mining, such as for Monero or Zcash. This malware establishes persistence by integrating an open-source mining tool into the system's startup routine without the user's consent. Advanced coin miners often employ techniques like timer configurations or CPU usage limits to operate discreetly and avoid detection.

File	FinalShell_license.exe
Checked	2024-10-24 08:28:38
MD5	d6d29befb8ab66846a8c83e1849daaeb
SHA1	ebb5d31a0391eb8f782df9d61af27a2baffebc70
SHA256	af36bb1797146886b03ff5c1baaa112e5a096fe44fdaeb8c3697c69312cd5611
SHA512	29a4e3177a49b3268672208842be6d6e42f149dce3869ce616a2558bb6f300b29f9c65aa30327cd26ec26de4558043b3796ada0985ac75417505bca763b63760
Imphash	a0a4be492eab39394d440335c7029fc5
File Size	7711744 bytes

Trojan.Win64.CoinMiner.oa!s1 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.CoinMiner.oa!s1 without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

CompanyName	Microsoft HQ Pty Ltd
FileDescription	System
FileVersion	4169
InternalName	win32
LegalCopyright	Copyright (C) 2006 - 2023 Microsoft HQ Pty Ltd
ProductName	win32
ProductVersion	4169
Translation	0x0000 0x04b0

Portable Executable Info

	ebd69b914a01d95fcf35342e11695d92 935b2e40aa64c32620497ac78d394f7b ccd0f0e8b29eaa93
Image Base:	0x00400000
Entry Point:	0x004014f0
Compilation:	2021-08-14 17:54:47
Checksum:	0x0075eea5 (Actual: 0x0075eea5)
OS Version:	4.0
PEiD:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Sign:	No valid SignedData structure was found.
Sections:	10
Imports:	ADVAPI32, CRYPT32, IPHLPAPI, KERNEL32, msvcrt, SHELL32, USER32, USERENV, WS2_32,
Exports:	0
Resources:	10

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00001000	0x00564508	0x00565000	ec7adc228dadc2517978db2c5288ac65	6.46
.data	0x00566000	0x000102e0	0x00010400	4a5a88bc0d33ddfdd8a0c4fe86f9c47d	3.12
.rdata	0x00577000	0x00121ed0	0x00122000	f2b462bf3827d705c0ca92897c677d34	6.02
.pdata	0x00699000	0x0002d684	0x0002d800	d940a77b092d11e3d85f83967258c625	6.37
.xdata	0x006c7000	0x00038944	0x00038a00	c848e2e89052d393f750dfb2608e15c7	5.02
.bss	0x00700000	0x003206a0	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.idata	0x00a21000	0x000045a0	0x00004600	30b3d40bb2e914f7459910d4aedebbe6	4.72
.CRT	0x00a26000	0x00000070	0x00000200	41a00dc7fc48dfd59b1775efb7ceb02e	0.32
.tls	0x00a27000	0x00000010	0x00000200	bf619eac0cdf3f68d496ea9344137e8b	0.00
.rsrc	0x00a28000	0x00057af7	0x00057c00	075115c8a2053462f0749c6d679b2fa8	6.01