Riskware/UtilityPowerTool20

description-logoAnalysis

Riskware/UtilityPowerTool20 is a detection for an potentially unwanted application. Below are some of its observed characteristics/behaviours:

  • This application is a utility that serves like an all in one kit, referring to itself as Antivirus/rootkit/bootkit tool.

  • This detection/tool has been associated/utilized with DarkSide Ransomware attack.

  • Below are some illustration of the application:

    • Figure 1: Tool Interface.


    • Figure 2: About Page.


    • Figure 3: StartUp Screen.


  • Following are some of the near/exact IOCs/file hash associated with this detection:
    • Md5: EA3999AF92A594402471748374A468FC
      Sha256: b1c7872598053eb2fd07b0eabe223cbccef2edd2e403255b5ab8646e32124862


recommended-action-logoRecommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiGate
Extended
FortiClient
Extreme
FortiAPS
FortiAPU
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR

Version Updates

Date Version Detail
2023-02-27 91.00982
2021-05-13 86.00146