Description
Solution
DearCry is a new ransomware variant that has been reported to exploit Microsoft Exchange server’s vulnerabilities. It uses AES-256 and RSA-2048 to encrypt the files on your machine without having to contact command-and-control server. DearCry also drops a ransom note on the desktop asking the victim to contact them via email.
Additional information about the virus can be found here:
Solution
FortiClient detects and blocks DearCry with both pre-execution signature-based detection and post-execution behaviour based detection. Anti-Malware feature detects and block malware file pre-execution and FortiClient Anti-Ransomware feature detects malicious behaviour and kills ransomware process post-execution.
FortiClient Anti-Malware Protection:
1. Enable FortiClient AV Real-Time Protection on EMS
2. Verify your AV signature is up-to-date
3. FortiClient AV blocks DearCry malware file before it can execute
Detection event on EMS:
FortiClient Detection Log:
FortiClient Anti-Ransomware Protection:
1. Enable Anti-Ransomware Protection
2. FortiClient detects and blocks malicious process behaviour
Detection Event on EMS:
Detection on FortiClient:
