{
  "family": "fugrafa",
  "sample_count": 17,
  "category": "ransomware",
  "description": "Fugrafa (classified in antivirus telemetry under signatures including Ransom:Win32/Fugrafa, Trojan-Ransom.Win32.Fugrafa, and Win32/Fugrafa) is a targeted Windows crypto-ransomware family designed for rapid local disk and corporate network share encryption. Propagated through weaponized email phishing links, software crack archives, and malicious download aggregators, Fugrafa conducts thorough pre-encryption system reconnaissance. It executes shell commands via cmd.exe to purge volume shadow copies ('vssadmin delete shadows /all /quiet'), suppress system startup recovery options ('bcdedit /set {default} bootstatuspolicy ignoreallfailures'), and terminate running database and mail services. Fugrafa then encrypts files across local storage drives and mounted network shares using AES-256 in CBC mode, appending the '.fugrafa' extension to locked files. It secures the AES symmetric session key using an embedded 2048-bit RSA master public key and creates ransom notes ('FUGRAFA_README.txt') across all processed directories with instructions on contacting operators via Tor.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Fugrafa",
    "Trojan-Ransom.Win32.Fugrafa",
    "Win32/Fugrafa",
    "Ransom.Fugrafa",
    "Fugrafa Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Fugrafa?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fugrafa is a Windows crypto-ransomware family that encrypts local hard drives and network folders using AES-256 and RSA-2048."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fugrafa disable system recovery mechanisms?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to purge volume shadow copies and bcdedit commands to suppress automatic boot recovery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fugrafa spread to victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via phishing email attachments, deceptive software installers, and bundled cracking utilities."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted with the .fugrafa extension be decrypted without paying?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No public decryption tool exists because Fugrafa uses industry-standard AES-256 with asymmetric RSA key wrapping."
      }
    },
    {
      "@type": "Question",
      "name": "What incident response steps should be taken during a Fugrafa infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate all affected network subnets immediately, preserve forensic memory images, block external C2/Tor traffic, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1489",
    "T1083",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Obfuscated Loaders",
    "Compromised Remote Desktop Protocol (RDP)",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Hybrid Cryptography (AES-256-CBC + RSA-2048)",
    "Automated Shadow Copy & Boot Recovery Deletion",
    "Database & Security Service Termination",
    "Local Hard Drive & Network Folder Traversal",
    "Automated Ransom Note Placement"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound connections to Tor proxy bridges or anonymous negotiation portals",
      "Internal SMB port scanning traffic detecting network file shares"
    ],
    "evasion_techniques": [
      "Terminating security software processes to prevent behavioral blocking",
      "Dynamic API resolution to hide cryptographic and file traversal functions"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a",
      "d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FugrafaLocker"
    ],
    "file_paths": [
      "%AppData%\\Fugrafa\\fugrafa.exe",
      "C:\\FUGRAFA_README.txt"
    ]
  },
  "defensive_measures": [
    "Maintain immutable, air-gapped backups to ensure business continuity without paying ransoms",
    "Enforce strict multi-factor authentication on all external-facing remote access endpoints",
    "Deploy endpoint detection and response (EDR) rules alerting on execution of vssadmin delete shadows"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Fugrafa",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Fugrafa"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Fugrafa",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Fugrafa.A",
      "Ransom:Win32/Fugrafa.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Corporate Ransom Demands",
  "sample_hashes": []
}