FEFG ransomware

[Dwee]

HI,

i just want to ask if mcafee already have this type of ransomware (.FEFG) covered ? and if already covered what is the latest amcore minimum coverage version ? because when i checked mvision insight mcafee still haven't coverage this threat yet, and is this latest DJVU ransomware new variant ? (the fefg),

we have some client encrypted with this ransomware (files encrypted to *.FEFG),

If we add mcafee ENS ATP what is the configuration for this threat? (policy , etc),

last thing, if we want to rise SR for this case, what the team needs ? fyi; we don't know where's the source file location (ransomware source file),

[Pravas]

Hi @Dwee ,

I understand you would like to check coverage for a ransomware variant.

Please log a malware ticket with support with the following information.

1. List of hashes that are related to the ransomware.

2. Source from where these hashes were gathered.

Please refer Coverage for a hash or list of hashes in the KB below.

https://kc.mcafee.com/corporate/index?page=content&id=KB91459

Thanks

[Dwee]

Hi Pravas,

thanks for your reply, what i meant is that what type of ransomware that encrypted our clients ? (files encrypted into *.FEFG), and  Has mcafee covered this type of ramsomware?

[Pravas · Accepted solution]

Hi @Dwee ,

Its difficult to verify Ransomware coverage just by variant name or file extension.

We require IOCs (Hash Values) to identify the exact sample. It can be then be added to coverage if found malicious.

We urge you to read about What is Ransomware in the link below.

https://www.trellix.com/en-in/security-awareness/ransomware/what-is-ransomware.html

Thanks

[Dwee]

yes Pravas, true we do need the correct sample file for analyze, but sadly the client already reinstall the unit without inform us to collect the sample, like Prakash also said same as yours (the one who handle my case) , i tried collect info about this extension ransomware in mvision insight and others source  it seems maybe  this is a new variant from Djavu family,