virus logo Virus

MSIL/Filecoder.RA!tr.ransom

description-logoAnalysis

MSIL/Filecoder.RA!tr.ransom is a generic detection for a Ransomware trojan. Since this is a generic detection, this malware may have varying behaviour.
Below are some of its observed characteristics/behaviours:

  • Affected files of this Ransomware will use the filenaming format {OriginalFilename.Ext}.slank .

  • This malware may also apply the following autorun registries:
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
      • DisableTaskmgr = 1
      The ransomware attempts to disable the task manager through this registry entry.

  • Below is an illustration of the malware's Ransom notes:

    • Figure 1: Possible Ransom note .



    • recommended-action-logoRecommended Action

    • Make sure that your FortiGate/FortiClient system is using the latest AV database.
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiClient
    Extreme
    FortiMail
    Extreme
    FortiSandbox
    Extreme
    FortiWeb
    Extreme
    Web Application Firewall
    Extreme
    FortiIsolator
    Extreme
    FortiDeceptor
    Extreme
    FortiEDR

    Version Updates

    Date Version Detail
    2019-04-09 67.67400 Sig Updated
    2019-02-05 66.16500 Sig Updated
    2019-01-15 65.66500 Sig Updated
    2019-01-15 65.66000 Sig Updated
    2019-01-07 65.47300 Sig Updated
    2019-01-03 65.37400 Sig Added
    ID 7971555
    Released Jan 16, 2019
    Description
    Updated    		 Jan 03, 2019
    Aliases Trojan-PSW.Win32.Mimikatz.zp,RDN/Generic PWS.y trojan,TROJ_GEN.R002C0PLO18,Trojan.GenericKD.40860458,a variant of MSIL/Filecoder.RA trojan,
    Platform Profile Microsoft Intermediate Language (used for MSIL compiled binaries)