MSIL/Nano.42F9!tr.ransom

description-logoAnalysis

MSIL/Nano.42F9!tr.ransom is a generic detection for a Ransomware Nano trojan. Since this is a generic detection, this malware may have varying behaviour.
Below are some of its observed characteristics/behaviours:

  • This malware may drop any of the following file(s):
    • #recovery_files#.txt : This text file will serve as ransom note. It is dropped in every infected folder.

  • This Ransomware may perform the following effects:
    • Deletes the volume shadow copies so that the user cannot restore them.
    • Sets the system up to ignore failures on future boots and disable an automatic repair effort.
    • Deletes backup catalog on the local system so that online backups become unavailable for the user to restore the system.

  • Affected files of this Ransomware will use the filenaming format {Original Filename.Ext}.Nano .

  • This malware was also observed to affect/encrypt files located on shared drived within the same subnet.

  • Affected victims of this Ransomware are redirected by the attacker via:
    • IamBaronSaturday@gmail.com

  • This malware may connect to any of the following remote sites(s):
    • 8{Removed}.99.66.31

  • This malware may apply any of the following registry modification(s):
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
      • Nanodefender = {Original Malware}.exe\ e
      This registry entry configures the malware to run everytime the infected user logs on the system.

  • Below is an illustration of the malware's Ransom notes:

    • Figure 1: Ransom note .



recommended-action-logoRecommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiGate
Extended
FortiClient
Extreme
FortiAPS
FortiAPU
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR

Version Updates

Date Version Detail
2019-01-29 65.99600 Sig Updated
2019-01-22 65.82800 Sig Updated
2019-01-10 65.53900 Sig Updated
2019-01-09 65.52000 Sig Updated