MSIL/FilecoderAHIHI.3A5D!tr.ransom

Analysis

MSIL/FilecoderAHIHI.3A5D!tr.ransom is a detection for a Ransomware trojan.
Below are some of its observed characteristics/behaviours:

• This malware may drop any of the following file(s):
  
  • %Desktop%\README.txt: This txt file will serve as ransom notes.


• Affected files of this Ransomware will keep original file name and extension.


• This malware only encrypts the following types of files:


• .docx
• .doc
• .xls
• .pdf
• .txt


• The malware will encrypt the file by the index header as “AHIHI”.


• This malware may connect to any of the following remote sites(s):
  
  • hxxp://rip{Ransom}.me


• This Ransomware encrypts files from the following directories:
  
  • Documents and Settings
  • ProgramData
  • PerfLogs
  • Recovery
  • Boot
  • Windows
  • winnt
  • Program Files (x86)
  • Program Files
  • thumbs.db
  • Recycle
  • System Volume Information


• Below is an illustration of the Ransom notes:
  

  Figure 1: Ransom Notes.

  
  

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.