

Rewterz Threat Alert – Formbook Malware Continues to target Victims via Phishing Emails
September 18, 2019
Rewterz Threat ALert – WannaCry Continues to Target Users
September 19, 2019
Rewterz Threat Alert – Formbook Malware Continues to target Victims via Phishing Emails
September 18, 2019
Rewterz Threat ALert – WannaCry Continues to Target Users
September 19, 2019Severity
High
Analysis Summary
A new ransomware called TFlower Ransomware is being used to target corporate environments. The ransomware is installed on networks after attackers hack into exposed Remote Desktop services. Once the attackers gain access to the machine, they will infect it and may attempt to traverse the network through tools such as PowerShell Empire, PSExec, etc. When executed, the ransomware will display a console that shows the activity being performed by the ransomware.
Once the encryption begins, connection to C2 server is made, which is located on a hacked WordPress site with the following URL.
https[:]//www[.]domain[.]com/wp-includes/wp-merge[.]php?name=[computer_name]&state=start
It will then proceed to encrypt the data on the computer, skipping any files in the Windows or Sample Music folders. When encrypting files, it will not add an extension, but will prepend the *tflower marker and what appears to be the encrypted encryption key for the file.
Ransom note file named “!_Notice_!.txt” is found throughout the computer and on the Windows Desktop, which looks like this:

Impact
- Files Encryption
- Loss of information
Indicators of Compromise
URLs
- hxxp[:]//www[.]domain[.]com/page[.]php
- hxxps[:]//www[.]domain[.]com/?utm_source={{Campaign-Source}}&utm_medium=email&utm_content={{Button-Name}}&utm_campaign={{Campaign-Name}}
- hxxp[:]//https[:]%2F%2Fwww[.]domain[.]com%2Fwp-includes%2Fwp-merge[.]php%3Fname%3D%5Bcomputer_name%5D&%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bstate%3Dsuccess%2520%5Bencrypted_file_count%5D/
- hxxp[:]//https[:]%2F%2Fwww[.]domain[.]com%2Fwp-includes%2Fwp-merge[.]php%3Fname%3D%5Bcomputer_name%5D&%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bstate%3Dstart/
Filename
chilli.exe
Email Address
- flower[.]harris[@]protonmail[.]com
- flower[.]harris[@]tutanota[.]com
Malware Hash (MD5/SHA1/SH256)
- 6c75998580fb05c01b10f4703299ffd782bec55c8765c030b8a4760fff6045fe
- 53c923d4e39b966ab951f9a3b9d090be
Remediation
- Block the threat indicators at their respective controls.
- Keep RDP services patched against all known vulnerabilities, specially the BlueKeep vulnerability.
- Do not follow links attached in emails coming from untrusted sources.
- Do not download files from email attachments or random sources on the internet without scanning them.