W32/Cypher.F308!tr.ransom

description-logoAnalysis

W32/Cypher.F308!tr.ransom is a detection for a Ransomware Cipher trojan.
Below are some of its observed characteristics/behaviours:

  • This malware may drop any of the following file(s):
    • HOW_TO_DECRYPT_FILES.html : This html file is dropped in every infected folder and will serve as ransom note.
    • %AppData%\[Random2].exe : This file is the copy of the original malware itself.
    • %AppData%\encryption_key : This file contains a set of encryption keys for the infected system.

  • Affected files of this Ransomware may use one of the following filenaming formats:
    • {OriginalFilename.Ext}.cypher
    • {OriginalFilename.Ext}.xcry7684

  • This malware was also observed to affect/encrypt files located on shared drive within the same subnet.

  • This malware was also observed to affect/encrypt files located on USB or external drives.

  • Affected victims of this Ransomware are redirected by the attacker via:
    • biggsurprise@tutanota.com
    • ochennado@tutanota.com
    • funnybtc@airmail.cc

  • This malware may apply any of the following registry modification(s):
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
      • [Random1] = %AppData%\[Random2].exe
      The malware configures itself to run every time the infected user logs on.

  • Below is an illustration of the malware's Ransom notes:

    • Figure 1: Ransom note.


    • Figure 2: Encryption key file.


recommended-action-logoRecommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiGate
Extended
FortiClient
FortiMail
FortiSandbox
FortiWeb
Web Application Firewall
FortiIsolator
FortiDeceptor
FortiEDR

Version Updates

Date Version Detail
2019-12-17 73.86100 Sig Updated
2019-04-12 67.75300 Sig Updated
2019-04-02 67.50600 Sig Updated
2019-01-30 66.02700 Sig Updated
2019-01-08 65.49200 Sig Updated
2019-01-07 65.46800 Sig Updated
2019-01-03 65.37300 Sig Updated