MSIL/WannaCry.6809!tr.ransom

description-logoAnalysis

MSIL/WannaCry.6809!tr.ransom is a generic detection for WannaCry .NET Ransomware.
Below are some of its observed characteristics/behaviours:

  • This is a .NET version for Ransomware WannaCry which has the same characteristics/behaviours as other versions of WannaCry. Generic description for WannaCry : W32/WannaCry.7E25!tr.ransom.

  • Below is an illustration of the malware's Ransom notes:

    • Figure 1: Ransom notes.


recommended-action-logoRecommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiClient
Extreme
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR

Version Updates

Date Version Detail
2019-03-05 66.83600 Sig Updated
2019-02-19 66.50500 Sig Updated