W32/Filecoder_Rapid.A!tr.ransom

Analysis

W32/Filecoder_Rapid.A!tr.ransom is a generic detection for the Rapid Ransomware trojan. Since this is a generic detection, this malware may have varying behaviour.
Below are some of its observed characteristics/behaviours:

• This malware may drop any of the following file(s):
  
  • How Recovery Files.txt : This file is dropped in every infected folder. It will serve as ransom note.
  • %Appdata%\recovery.txt : This file is the copy of file "How Recovery Files.txt".It will serve as ransom note when the user logs in to the system.
  • %Appdata%\info.exe. : This file is a copy of the malware itself.


• Affected files of this Ransomware will use the following filenaming format:
  
• {original name}.no_more_ransom
• {original name}.rapid

• HKCU\Software\Microsoft\Windows\Currentversion\Run
  
  • userinfo = %Appdata%\recovery.txt
  It will display the ransom note when the user logs in to the system.

Below is an illustration of the malware's Ransom notes:

Figure 1: Ransomware Notes.

Figure 2: Ransomware Notes

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.