• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Formbook Malware Continues to target Victims via Phishing Emails
September 18, 2019
Rewterz Threat ALert – WannaCry Continues to Target Users
September 19, 2019

Rewterz Threat Alert – TFlower Ransomware Targeting Businesses

September 18, 2019

Severity

High

Analysis Summary

A new ransomware called TFlower Ransomware is being used to target corporate environments. The ransomware is installed on networks after attackers hack into exposed Remote Desktop services. Once the attackers gain access to the machine, they will infect it and may attempt to traverse the network through tools such as PowerShell Empire, PSExec, etc. When executed, the ransomware will display a console that shows the activity being performed by the ransomware.

Once the encryption begins, connection to C2 server is made, which is located on a hacked WordPress site with the following URL. 

https[:]//www[.]domain[.]com/wp-includes/wp-merge[.]php?name=[computer_name]&state=start

It will then proceed to encrypt the data on the computer, skipping any files in the Windows or Sample Music folders. When encrypting files, it will not add an extension, but will prepend the *tflower marker and what appears to be the encrypted encryption key for the file.

 Ransom note file named “!_Notice_!.txt” is found throughout the computer and on the Windows Desktop, which looks like this:

image-1568809813.png

Impact

  • Files Encryption
  • Loss of information

Indicators of Compromise

URLs

  • hxxp[:]//www[.]domain[.]com/page[.]php
  • hxxps[:]//www[.]domain[.]com/?utm_source={{Campaign-Source}}&utm_medium=email&utm_content={{Button-Name}}&utm_campaign={{Campaign-Name}}
  • hxxp[:]//https[:]%2F%2Fwww[.]domain[.]com%2Fwp-includes%2Fwp-merge[.]php%3Fname%3D%5Bcomputer_name%5D&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bstate%3Dsuccess%2520%5Bencrypted_file_count%5D/
  • hxxp[:]//https[:]%2F%2Fwww[.]domain[.]com%2Fwp-includes%2Fwp-merge[.]php%3Fname%3D%5Bcomputer_name%5D&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bstate%3Dstart/

Filename

chilli.exe

Email Address

  • flower[.]harris[@]protonmail[.]com
  • flower[.]harris[@]tutanota[.]com

Malware Hash (MD5/SHA1/SH256)

  • 6c75998580fb05c01b10f4703299ffd782bec55c8765c030b8a4760fff6045fe
  • 53c923d4e39b966ab951f9a3b9d090be

Remediation

  • Block the threat indicators at their respective controls.
  • Keep RDP services patched against all known vulnerabilities, specially the BlueKeep vulnerability.
  • Do not follow links attached in emails coming from untrusted sources.
  • Do not download files from email attachments or random sources on the internet without scanning them.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.