Riskware/XMRigCoinMiner Riskware/XMRigCoinMiner is a generic detection for an unwanted application. Since this is a generic detection, Grayware samples that are detected as such may have varying behaviour. Below are some of its observed characteristics/behaviours: This application are mostly utility intended for coinmining, based on open source XMRig. XMRig on its own is safe, nonetheless there have been instances where this open source was modified/rig/bundled to affect unknowingly users. In some cases the utility itself has been modified/changed to dupe a user into thinking its an entirely different application.
Cryptomining or coinmining is a process of using a user's CPU time to perform calculations and/or to contribute to a network of other coin miners.
Below are some illustration of the application: Figure 1: File's/Application Property page. Figure 2: Application appears to require some configuration. Following are some of the near/exact IOCs/file hash associated with this detection: Md5: d6854833857e5448ae0842a1ac3b4143 Sha256: a4cb98d874e05e77a4e8bb369037f4d814fb2403427480078c4aa61d0668afc9
Make sure that your FortiGate/FortiClient system is using the latest AV database.
Quarantine/delete files that are detected and replace infected files with clean backup copies.
