Rewterz Threat Alert – TFlower Ransomware Targeting Businesses

Severity

High

Analysis Summary

A new ransomware called TFlower Ransomware is being used to target corporate environments. The ransomware is installed on networks after attackers hack into exposed Remote Desktop services. Once the attackers gain access to the machine, they will infect it and may attempt to traverse the network through tools such as PowerShell Empire, PSExec, etc. When executed, the ransomware will display a console that shows the activity being performed by the ransomware.

Once the encryption begins, connection to C2 server is made, which is located on a hacked WordPress site with the following URL. 

https[:]//www[.]domain[.]com/wp-includes/wp-merge[.]php?name=[computer_name]&state=start

It will then proceed to encrypt the data on the computer, skipping any files in the Windows or Sample Music folders. When encrypting files, it will not add an extension, but will prepend the *tflower marker and what appears to be the encrypted encryption key for the file.

 Ransom note file named “!_Notice_!.txt” is found throughout the computer and on the Windows Desktop, which looks like this:

Impact

• Files Encryption
• Loss of information

Indicators of Compromise

URLs

• hxxp[:]//www[.]domain[.]com/page[.]php
• hxxps[:]//www[.]domain[.]com/?utm_source={{Campaign-Source}}&utm_medium=email&utm_content={{Button-Name}}&utm_campaign={{Campaign-Name}}
• hxxp[:]//https[:]%2F%2Fwww[.]domain[.]com%2Fwp-includes%2Fwp-merge[.]php%3Fname%3D%5Bcomputer_name%5D&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bstate%3Dsuccess%2520%5Bencrypted_file_count%5D/
• hxxp[:]//https[:]%2F%2Fwww[.]domain[.]com%2Fwp-includes%2Fwp-merge[.]php%3Fname%3D%5Bcomputer_name%5D&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bstate%3Dstart/

Filename

chilli.exe

Email Address

• flower[.]harris[@]protonmail[.]com
• flower[.]harris[@]tutanota[.]com

Malware Hash (MD5/SHA1/SH256)

• 6c75998580fb05c01b10f4703299ffd782bec55c8765c030b8a4760fff6045fe
• 53c923d4e39b966ab951f9a3b9d090be

Remediation

• Block the threat indicators at their respective controls.
• Keep RDP services patched against all known vulnerabilities, specially the BlueKeep vulnerability.
• Do not follow links attached in emails coming from untrusted sources.
• Do not download files from email attachments or random sources on the internet without scanning them.