Riskware/CoinHive

Analysis

Riskware/CoinHive is a detection for a Javascript Riskware associated with Bitcoin mining.
Below are some of its characteristics/behaviours:

• This threats has been found to be in the form of inserted Redirect URL to some affected sites. The redirected URL points to hxxps://coin-hiv{Removed}.com/lib/coinhive.min.js.


• Based on our analysis this threats is aimed towards bitcoin mining.


• Affected sites are believed to have been compromised and thus would serve these Injected pages to unsuspecting users.

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.