VirusRiskware/CoinHive
Analysis
Riskware/CoinHive is a detection for a Javascript and HTML Riskware associated with Bitcoin mining.
Since this is a generic detection, this malware may have varying behaviour.
Below are some of its observed characteristics/behaviours:
- This threats has been found to be in the form of inserted Redirect URL to some affected sites. The redirected URL points to hxxps://coin-hiv{Removed}.com/lib/coinhive.min.js.
- Based on our analysis this threats is aimed towards bitcoin mining.
- Affected sites are believed to have been compromised and thus would serve these Injected pages to unsuspecting users.
Recommended Action
- Make sure that your FortiGate/FortiClient system is using the latest AV database.
- Quarantine/delete files that are detected and replace infected files with clean backup copies.
Telemetry
Detection Availability
| FortiGate | |
|---|---|
| Extended | |
| FortiClient | |
| FortiMail | |
| FortiSandbox | |
| FortiWeb | |
| Web Application Firewall | |
| FortiIsolator | |
| FortiDeceptor | |
| FortiEDR |
Version Updates
| Date | Version | Detail |
|---|---|---|
| 2021-09-21 | 89.02510 | |
| 2021-09-14 | 89.01080 | |
| 2021-04-05 | 85.00239 | |
| 2020-11-03 | 81.56700 | Sig Updated |
| 2019-07-09 | 69.85400 | Sig Updated |
| 2019-05-07 | 68.34600 | Sig Updated |
| 2019-05-03 | 68.25100 | Sig Updated |
| 2019-05-03 | 68.25000 | Sig Updated |
| 2019-05-03 | 68.24700 | Sig Updated |
| 2018-10-31 | 63.84300 | Sig Updated |