and which of the files shall contain the trojan?

you know that there is a miner in your file?
normally, the av-tools recognize them as bitcoin-miner, but as it is in python and new, maybe they name it "wrong".