MSIL/Gen.SY!tr.ransom

description-logoAnalysis

MSIL/Gen.SY!tr.ransom is a generic detection for a Ransomware Gen trojan. Since this is a generic detection, this malware may have varying behaviour.
Below are some of its observed characteristics/behaviours:

  • This malware may drop any of the following file(s):
    • %Desktop%\Instructions.txt : This file is dropped on the desktop and serves as the note.
  • This Ransomware encrypts all of the files in %Desktop%. During encryption, cmd.exe shows the message 'Encrypting OriginalFileName.ext as it encrypts files.
  • Affected files of this Ransomware will use the filenaming format OriginalFileName.ext.brown, where italic strings are replaced.
  • If the Ransomware file is located in %Desktop% the program will terminate when it tries to encrypt itself.
  • Below is an illustration of the malware's Ransom notes:
    • Figure 1: Ransom note.
    • Figure 2: cmd.exe output.

recommended-action-logoRecommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiGate
Extended
FortiClient
Extreme
FortiAPS
FortiAPU
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR

Version Updates

Date Version Detail
2019-07-23 70.19000 Sig Updated
2019-06-12 69.19900 Sig Updated