MSIL/ROILocker.69E1!tr.ransom

description-logoAnalysis

MSIL/ROILocker.69E1!tr.ransom is a generic detection for a Ransomware ROILocker trojan. Since this is a generic detection, this malware may have varying behaviour.
Below are some of its observed characteristics/behaviours:

  • This malware may drop any of the following file(s):
    • %Appdata%\Cryptohost.exe: This file is the copy of the original malware itself.
    • %Temp%\utorrent.exeutorrent.exe : This file is the uTorrent installer.

  • This Ransomware comes bundled with the uTorrent installer.

  • This Ransomware locks the screen after running and displays the ransom note.

  • Below is an illustration of the malware's Ransom notes:

    • Figure 1:Ransom note.


    • Figure 2:Ransom note.

    • Figure 3: Ransom note.

    • Figure 4: Ransom note.


recommended-action-logoRecommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiGate
Extended
FortiClient
Extreme
FortiAPS
FortiAPU
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR

Version Updates

Date Version Detail
2019-04-09 67.67400 Sig Updated
2019-03-04 66.81700 Sig Added