Virus

Riskware/CoinHive

Analysis



Riskware/CoinHive is a detection for a Javascript and HTML Riskware associated with Bitcoin mining. Since this is a generic detection, this malware may have varying behaviour.
Below are some of its observed characteristics/behaviours:

  • This threats has been found to be in the form of inserted Redirect URL to some affected sites. The redirected URL points to hxxps://coin-hiv{Removed}.com/lib/coinhive.min.js.

  • Based on our analysis this threats is aimed towards bitcoin mining.

  • Affected sites are believed to have been compromised and thus would serve these Injected pages to unsuspecting users.



Recommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.