How do I check that I am protected against the WannaCry Ransomware Attack?

03/26/2020 1033 12302

DESCRIPTION:

If you are a SonicWall customer, and you have an active Gateway Anti-Virus subscription, your SonicWall firewall has been protecting your network from WannaCry (also known as WanaCrypt0r or WannaCrypt) ransomware since April 20, 2017.

This article explains how to check that your Gateway Anti-Virus is up to date with the correct signatures to protect your network against the WannaCry/WannaCrypt attack.

WannaCrypt.RSM is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.

RESOLUTION:

For full details about the WannaCry Ransomware Attack you can read our SonicALERT.

Here's how to check that your Gateway Anti-Virus status has been updated since SonicWall first identified this virus and added the appropriate signatures to our databases:

1. In your SonicWall firewall, go to Security Services.
2. Click Gateway Anti-Virus.
3. Check that the Signature Database Timestamp is April 20th or later.

You can also check for the below signatures by using the Lookup Signatures Containing String section on the same page.

SonicWall covers multiple variants of this threat via the following signatures:

• GAV: WannaCrypt.RSM (Trojan)
• GAV: WannaCrypt.RSM_2 (Trojan)
• GAV: WannaCrypt.RSM_3 (Trojan)
• GAV: HydraCrypt.C (Trojan)

Since SonicWall Email Security uses the same signatures/definitions as UTM Gateway Security, we can effectively block the emails that deliver the initial route to infection. Ensure all email security services are also up to date to block malicious emails.

SonicWall has also released the following blog statement about this Ransomware Attack:
https://blog.sonicwall.com/2017/05/sonicwall-protects-customers-latest-massive-wannacry-ransomware-attack/

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

For full details about the WannaCry Ransomware Attack you can read our SonicALERT.

Here's how to check that your Gateway Anti-Virus status has been updated since SonicWall first identified this virus and added the appropriate signatures to our databases:

1. Login to your SonicWall firewall
2. Click Manage in the top navigation menu.
3. Navigate to Security Configuration | Security Services | Gateway Anti-Virus .
4. Check that the Signature Database Timestamp is April 20th or later.

You can also check for the below signatures by using the Lookup Signatures Containing String section on the same page.

SonicWall covers multiple variants of this threat via the following signatures:

• GAV: WannaCrypt.RSM (Trojan)
• GAV: WannaCrypt.RSM_2 (Trojan)
• GAV: WannaCrypt.RSM_3 (Trojan)
• GAV: HydraCrypt.C (Trojan)

Since SonicWall Email Security uses the same signatures/definitions as UTM Gateway Security, we can effectively block the emails that deliver the initial route to infection. Ensure all email security services are also up to date to block malicious emails.

SonicWall has also released the following blog statement about this Ransomware Attack:
https://blog.sonicwall.com/2017/05/sonicwall-protects-customers-latest-massive-wannacry-ransomware-attack/