W32/CoinMiner.TY!tr

Analysis

W32/CoinMiner.TY!tr is a generic detection for a trojan associated with Bitcoin mining. Since this is a generic detection, this malware may have varying behaviour.
Below are some of its observed characteristics/behaviours:

• This malware may connect to the following site(s) and may download the file wall.get.xml:
  
  • hxxp://api.{Removed}.com/method/wall.get.xml
  • 1.{Removed}.z8.ru


• This malware creates the following mutex
  
  • SamaelLovesMe


• This malware creates the following processes
  
  • ActivateDesktop.exe
  • registry_tool.exe -autorun C:\.Trash-100\ActivateDesktop.exe


• This malware may also try to open the following files
  
  • framework_exe
  • miner_exe_name
  • 2ee31f9a6a0720f7074b05e7b0f3d9c2792c4c707f0af30e5896331c531f1720
  • ActivateDesktop.exe
  • registry_tool.exe
  • registry_tool.exe -autorun

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.