VirusW32/EvilLocker.NSF!tr.ransom
Analysis
W32/EvilLocker.NSF!tr.ransom is a generic detection for Ransomware Evil Locker.
Below are some of its observed characteristics/behaviours:
- This is a 32bit version for Ransomware Evil Locker which has the same characteristics/behaviours as 64bit version: W64/Filecoder.U!tr.ransom.
Recommended Action
- Make sure that your FortiGate/FortiClient system is using the latest AV database.
- Quarantine/delete files that are detected and replace infected files with clean backup copies.
Telemetry
Detection Availability
| FortiClient | |
|---|---|
| Extreme | |
| FortiMail | |
| Extreme | |
| FortiSandbox | |
| Extreme | |
| FortiWeb | |
| Extreme | |
| Web Application Firewall | |
| Extreme | |
| FortiIsolator | |
| Extreme | |
| FortiDeceptor | |
| Extreme | |
| FortiEDR |