PUP.Coiner.A

The detection of PUP.Coiner.A on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it to prevent any potential harm.

What Is PUP.Coiner.A?

PUP.Coiner.A is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your privacy. PUPs are often installed on a system without the user's knowledge or consent, and they can be difficult to remove.

How PUP.Coiner.A Operates

PUP.Coiner.A, like other PUPs, can operate in various ways to achieve its goals. It may display unwanted advertisements, collect user data, or install additional malware on the system. PUPs can also slow down system performance, cause crashes, and interfere with other programs. In some cases, PUPs can even be used to distribute more severe malware, making it essential to remove them as soon as possible.

Symptoms of Infection

If your system is infected with PUP.Coiner.A, you may notice various symptoms. These can include slow system performance, unwanted advertisements or pop-ups, and unfamiliar programs or icons on your desktop. You may also experience crashes, freezes, or errors, and your browser settings may be altered without your consent. Additionally, you may notice that your system is using more resources than usual, or that your internet connection is slower than normal.

• Unwanted advertisements or pop-ups
• Slow system performance
• Unfamiliar programs or icons on your desktop
• Crashes, freezes, or errors
• Altered browser settings
• Increased system resource usage
• Slower internet connection

How to Remove PUP.Coiner.A

1. Boot your system in Safe Mode with Networking to prevent PUP.Coiner.A from loading and to allow for a more effective removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malware, including PUP.Coiner.A.
3. Uninstall any suspicious programs or applications that you do not recognize or that were installed without your consent.
4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any alterations made by PUP.Coiner.A.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that PUP.Coiner.A has been completely removed.

Conclusion

Removing PUP.Coiner.A from your system is crucial to prevent any potential harm and to restore your system's performance and security. By following the steps outlined above, you can effectively remove this potentially unwanted program and protect your system from future infections. It's also essential to practice safe computing habits, such as avoiding suspicious downloads and links, to prevent similar infections in the future. Regularly scanning your system with a reputable anti-malware tool can also help detect and remove any malware, including PUPs, before they cause harm.

Analysis Report

General information

Family Name:	PUP.Coiner.A
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: dfbc97e90a8fa55c58943b637121b657 SHA1: eb8db937d2570701263b027a8f1c654e5cc8119e File Size: 9.05 MB, 9053696 bytes

MD5: e5d03ff4881557b22954bb0c6ddb680f SHA1: cd747bfb07a6f3883de7c326d7ac36c467f84d32 SHA256: 80E08307CAC0D9D014433E1C4DD5DB2ACF60EB068BC3B9FC6D0709A3A4841E97 File Size: 6.15 MB, 6152206 bytes

MD5: ee3594f47f70042f92da2e256ab10d93 SHA1: e98553234f30bd3a3f17b57005b8868b5c007271 SHA256: 86E5AE98F3EB1D853BCB8F60E5B3891C699E081DF0454E8861B65877E0EEF7E0 File Size: 8.85 MB, 8848384 bytes

MD5: 5ee1e751eee7443cc82396c864e67731 SHA1: 162051824906f857ca446e7867850e47a444e755 SHA256: 9F259190B3C3163710CDDE737D3C1BA0BE63EBC6558FA6E847F400545E50971F File Size: 6.32 MB, 6319630 bytes

MD5: 4e57b5e36d7cdaf00d7df883ee2c9571 SHA1: ab73ed7e62a4f07dbf362a1d18a030422939d69b SHA256: CCDDB2DC6BA8953D91BABC7D92D3D13A6B88B83A2EC37765233C47F8D85D0253 File Size: 9.61 MB, 9609728 bytes

Show More

MD5: 3eadf61d79ebb1cfc54fcf1e09131b4a SHA1: 507d9a255af64011f952d8c8832319b7c0773834 SHA256: 4724A8AD62407BAB5277A0720C5B2399333EB383DFF056C3FEA2AF3DA879A58E File Size: 6.52 MB, 6524942 bytes

MD5: 73a7691512780ae0d02b41f13e807157 SHA1: fd8e57198bb6d6cde9638078f5194954260b5358 SHA256: 550A198D6106B18B26C5BAD54F6CB622E848CAFC38DB9D80425495F77486F45E File Size: 8.06 MB, 8057278 bytes

MD5: 4e679ce9c720e0bf253d31fa6bc67296 SHA1: fa7c6dc57748e6b192cf655dbd6554cff716714a SHA256: CAD82BC5444C16DB8BBD752ED3EFF3992768205EA67F0A0FDEDA08DA8C9AF450 File Size: 9.43 MB, 9428862 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have resources
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)

Show More

• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Bitcoin Dogecoin Fortcoin Litecoin project
Company Website	http://dogecoin.com http://www.litecoin.org/
File Description	bitcoind (Bitcoin node with a JSON-RPC server) Dogecoin-Qt (OSS GUI client for Dogecoin) Fortcoind (OSS daemon/client for Fortcoin)
File Version	1.12.0.2 1.6.0.0 1.5.0.0 1.1.0.0 0.6.3
Internal Name	bitcoind dogecoin-qt Fortcoind
Legal Copyright	2009-2016 The Bitcoin Core Developers, 2014-2016 The Fortcoin Core Developers 2017 The ATBcoin Core developers Dogecoin developers 2013-2014, Litecoin developers, The Bitcoin developers 2009-2013
Legal Trademarks1	Distributed under the MIT/X11 software license, see the accompanying file COPYING or http://www.opensource.org/licenses/mit-license.php. Distributed under the MIT software license, see the accompanying file COPYING or http://www.opensource.org/licenses/mit-license.php.
Original Filename	bitcoind.exe dogecoin-qt.exe Fortcoind.exe
Product Name	bitcoind Dogecoin Dogecoin-Qt Fortcoind Litecoin
Product Version	1.12.0.2 1.6.0.0 1.5.0.0 1.1.0.0 0.6.3

File Traits

• HighEntropy
• imgui
• No Version Info
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Coiner.A

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\srvsvc	Generic Read,Write Data,Write Attributes,Write extended,Append data
\device\namedpipe\wkssvc	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsj55aa.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsj55aa.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsj55aa.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsj55aa.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsj55aa.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl676.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl676.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl676.tmp\modern-wizard.bmp	Synchronize,Write Attributes

Show More

c:\users\user\appdata\local\temp\nsl676.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl676.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsp557b.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsw666.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\roaming\digigems\.lock	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\.lock	Generic Write,Read Attributes
c:\users\user\appdata\roaming\digigems\__db.001	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\__db.80000001.19d4743f	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\blocks\blk00000.dat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\blocks\index\000001.dbtmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\blocks\index\000002.dbtmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\blocks\index\000003.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\blocks\index\current	Synchronize,Write Data
c:\users\user\appdata\roaming\digigems\blocks\index\log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\blocks\index\manifest-000001	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\blocks\index\manifest-000002	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\chainstate\000001.dbtmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\chainstate\000002.dbtmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\chainstate\000003.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\chainstate\current	Synchronize,Write Data
c:\users\user\appdata\roaming\digigems\chainstate\log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\chainstate\manifest-000001	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\chainstate\manifest-000002	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\database\log.0000000001	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\db.log	Generic Write,Read Attributes
c:\users\user\appdata\roaming\digigems\debug.log	Generic Write,Read Attributes
c:\users\user\appdata\roaming\digigems\wallet.dat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\digigems\wallet.dat	Synchronize,Write Data
c:\users\user\downloads\temp\shsandbox-win32.dll-5.22.1.9999-x86.dmp	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\services\.net clr data\linkage::export	.NET CLR Data	RegNtPreCreateKey
HKLM\system\controlset001\services\.net clr networking\linkage::export	.NET CLR Networking	RegNtPreCreateKey
HKLM\system\controlset001\services\.net data provider for oracle\linkage::export	.NET Data Provider for Oracle	RegNtPreCreateKey
HKLM\system\controlset001\services\.net data provider for sqlserver\linkage::export	.NET Data Provider for SqlServer	RegNtPreCreateKey
HKLM\system\controlset001\services\msdtc bridge 3.0.0.0\linkage::export	MSDTC Bridge 3.0.0.0	RegNtPreCreateKey
HKLM\system\controlset001\services\servicemodelendpoint 3.0.0.0\linkage::export	ServiceModelEndpoint 3.0.0.0	RegNtPreCreateKey
HKLM\system\controlset001\services\servicemodeloperation 3.0.0.0\linkage::export	ServiceModelOperation 3.0.0.0	RegNtPreCreateKey
HKLM\system\controlset001\services\servicemodelservice 3.0.0.0\linkage::export	ServiceModelService 3.0.0.0	RegNtPreCreateKey
HKLM\system\controlset001\services\smsvchost 3.0.0.0\linkage::export	SMSvcHost 3.0.0.0	RegNtPreCreateKey
HKLM\system\controlset001\services\windows workflow foundation 3.0.0.0\linkage::export	Windows Workflow Foundation 3.0.0.0	RegNtPreCreateKey

Show More

HKLM\system\controlset001\services\bits\performance::1008	ʟ幑ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bits\performance::1008	ꏭ㭈醂ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\msdtc\performance::1009	⭃㭱醂ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\msdtc\performance::disable performance counters		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Network Winsock2	WSAStartup
Encryption Used	CryptAcquireContext
User Data Access	GetComputerName GetUserObjectInformation
Network Winsock	bind freeaddrinfo getaddrinfo getnameinfo setsockopt socket