Smart Filter for CryptoLocker Ransomware on Deep Discovery Inspector (DDI)

To generate a Smart Filter to search for this kind of Malware in DDI (version 3.8 and higher):

1. Go to All Detections.
2. Click on Advanced.

3. • For DDI 3.8 SP1 and lower versions:

     On the Filter section, select Detection Name on the first dropdown menu.

   • For DDI 3.8 SP2 and higher versions:

     On the first dropdown menu, select Threat/Detection/Reference.

4. On the second dropdown menu, select Contains.

5. On the last field of the Filter section, type the following criteria:

   PE_VIRLOCK, TROJ_CRYPAURA, TROJ_CRYPTCOIN, JS_DOWNCRYPT, BAT_CRYPBOT, BAT_CRYPTOR, CRITOLOCK, ANDROIDOS_RANSOM, JS_DOWNCRYPT, TROJ_CRYPTFILE, TROJ_CRYPCTB, TROJ_CRYPTROLF, TROJ_CRILOCK, TROJ_CRYPTOR, TROJ_POSHCODER, ANDROIDOS_LOCKER, TROJ_CRIBIT, TROJ_CRYPTORBIT, TROJ_CRYPTDEF, TROJ_CRYPDEF, TROJ_CRYPTWALL, TROJ_CRYPWALL

   

6. Click Search.