False Positive Report - Headline Studio (Chrome Extension)

[rveitch]

Our Chrome extension has received a few RiskWare.BitCoinMiner.Generic false positive reports from Malwarebytes customers. Attached is a copy of the log report from one customer. I was unable to reproduce the false positive on OSX, so it's likely only happening on Windows.

Thanks in advance for helping resolve the issue. 

fpreport.txt.zip

[rveitch]

Here is a copy of a second log set we've recieved. 

fpreport-2.txt.zip

[cli]

This is occurring because of crypto-loot in \APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\JBNBHBMNBPFAOHGJCLJLCBGNELCLKAAE\1.2.1_0\JS\SPOKE.BUNDLE.JS.

[rveitch]

@cllDo you mean simply the reference to that word? If so, I believe what you are referring to is the wappalyzer defintions meant for detection against crypto-Loot, which is a pretty big false-positive I'd say.  Here's a link to the wappalyzer source code definitions. https://github.com/AliasIO/wappalyzer/blob/76890d3e60f7168859509011bf81e642b1b4b9eb/src/technologies.json#L4450-L4467

[cli]

The rule detects on more than just the reference to the word so we haven't seen any one else report a false positive on it yet. Thanks for reporting, this will be fixed in the next update.

[rveitch]

@cliThank you for the quick response and assistance!