SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tflower (Back to overview)

TFlower


TFlower is a new ransomware targeting mostly corporate networks discovered in August, 2019. It is reportedly installed on networks by attackers after they gain access via RDP. TFlower displays a console showing activity being performed by the ransomware when it encrypts a machine, further indicating that this ransomware is triggered by the attacker post compromise, similar to Samsam/Samas in terms of TTP. Once encryption is started, the ransomware will conduct a status report to an apparently hard-coded C2. Shadow copies are deleted and the Windows 10 repair environment is disabled by this ransomware. This malware also will terminate any running Outlook.exe process so that the mail files can be encrypted. This ransomware does not add an extention to encrypted files, but prepends the marker "*tflower" and what may be the encrypted encryption key for the file to each affected file. Once encryption is completed, another status report is sent to the C2 server.

References
2021-03-03SYGNIAAmitai Ben Shushan, Noam Lifshitz, Amnon Kushnir, Martin Korman, Boaz Wasserman
@online{shushan:20210303:lazarus:60339a7, author = {Amitai Ben Shushan and Noam Lifshitz and Amnon Kushnir and Martin Korman and Boaz Wasserman}, title = {{Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware}}, date = {2021-03-03}, organization = {SYGNIA}, url = {https://www.sygnia.co/mata-framework}, language = {English}, urldate = {2021-03-04} } Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware
Dacls Dacls Dacls TFlower
2019-09-20Canadian Centre for Cyber SecurityCanadian Centre for Cyber Security
@online{security:20190920:tflower:90d959d, author = {Canadian Centre for Cyber Security}, title = {{TFlower Ransomware Campaign}}, date = {2019-09-20}, organization = {Canadian Centre for Cyber Security}, url = {https://cyber.gc.ca/en/alerts/tflower-ransomware-campaign}, language = {English}, urldate = {2020-01-10} } TFlower Ransomware Campaign
TFlower
2019-09-17Bleeping ComputerLawrence Abrams
@online{abrams:20190917:tflower:31c9072, author = {Lawrence Abrams}, title = {{TFlower Ransomware - The Latest Attack Targeting Businesses}}, date = {2019-09-17}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/tflower-ransomware-the-latest-attack-targeting-businesses/}, language = {English}, urldate = {2019-10-15} } TFlower Ransomware - The Latest Attack Targeting Businesses
TFlower
Yara Rules
[TLP:WHITE] win_tflower_auto (20220808 | Detects win.tflower.)
rule win_tflower_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-08-05"
        version = "1"
        description = "Detects win.tflower."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tflower"
        malpedia_rule_date = "20220805"
        malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71"
        malpedia_version = "20220808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b44241c c1e810 0fb6c0 8b0c8d20e14e00 330c8520dd4e00 }
            // n = 5, score = 200
            //   8b44241c             | mov                 eax, dword ptr [esp + 0x1c]
            //   c1e810               | shr                 eax, 0x10
            //   0fb6c0               | movzx               eax, al
            //   8b0c8d20e14e00       | mov                 ecx, dword ptr [ecx*4 + 0x4ee120]
            //   330c8520dd4e00       | xor                 ecx, dword ptr [eax*4 + 0x4edd20]

        $sequence_1 = { 0001 7708 00f3 7608 }
            // n = 4, score = 200
            //   0001                 | add                 byte ptr [ecx], al
            //   7708                 | ja                  0xa
            //   00f3                 | add                 bl, dh
            //   7608                 | jbe                 0xa

        $sequence_2 = { 0001 0200 0103 0303 }
            // n = 4, score = 200
            //   0001                 | add                 byte ptr [ecx], al
            //   0200                 | add                 al, byte ptr [eax]
            //   0103                 | add                 dword ptr [ebx], eax
            //   0303                 | add                 eax, dword ptr [ebx]

        $sequence_3 = { 001a 0c05 003c0c 05004e0c05 }
            // n = 4, score = 200
            //   001a                 | add                 byte ptr [edx], bl
            //   0c05                 | or                  al, 5
            //   003c0c               | add                 byte ptr [esp + ecx], bh
            //   05004e0c05           | add                 eax, 0x50c4e00

        $sequence_4 = { 0008 7408 0002 7408 }
            // n = 4, score = 200
            //   0008                 | add                 byte ptr [eax], cl
            //   7408                 | je                  0xa
            //   0002                 | add                 byte ptr [edx], al
            //   7408                 | je                  0xa

        $sequence_5 = { ff15???????? 85c0 0f8406030000 8d85e8fdffff 50 }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   0f8406030000         | je                  0x30c
            //   8d85e8fdffff         | lea                 eax, [ebp - 0x218]
            //   50                   | push                eax

        $sequence_6 = { 000f 7708 0001 7708 }
            // n = 4, score = 200
            //   000f                 | add                 byte ptr [edi], cl
            //   7708                 | ja                  0xa
            //   0001                 | add                 byte ptr [ecx], al
            //   7708                 | ja                  0xa

        $sequence_7 = { ff742430 57 ff15???????? 83f8ff }
            // n = 4, score = 200
            //   ff742430             | push                dword ptr [esp + 0x30]
            //   57                   | push                edi
            //   ff15????????         |                     
            //   83f8ff               | cmp                 eax, -1

        $sequence_8 = { 0010 740b 0021 740b }
            // n = 4, score = 200
            //   0010                 | add                 byte ptr [eax], dl
            //   740b                 | je                  0xd
            //   0021                 | add                 byte ptr [ecx], ah
            //   740b                 | je                  0xd

        $sequence_9 = { 8b442430 0fb6c0 331c8520f54e00 335f08 0fb6c2 8b148d20ed4e00 }
            // n = 6, score = 200
            //   8b442430             | mov                 eax, dword ptr [esp + 0x30]
            //   0fb6c0               | movzx               eax, al
            //   331c8520f54e00       | xor                 ebx, dword ptr [eax*4 + 0x4ef520]
            //   335f08               | xor                 ebx, dword ptr [edi + 8]
            //   0fb6c2               | movzx               eax, dl
            //   8b148d20ed4e00       | mov                 edx, dword ptr [ecx*4 + 0x4eed20]

        $sequence_10 = { 0fb64102 0fb680589e4e00 884102 0fb64103 0fb680589e4e00 884103 0fb64104 }
            // n = 7, score = 200
            //   0fb64102             | movzx               eax, byte ptr [ecx + 2]
            //   0fb680589e4e00       | movzx               eax, byte ptr [eax + 0x4e9e58]
            //   884102               | mov                 byte ptr [ecx + 2], al
            //   0fb64103             | movzx               eax, byte ptr [ecx + 3]
            //   0fb680589e4e00       | movzx               eax, byte ptr [eax + 0x4e9e58]
            //   884103               | mov                 byte ptr [ecx + 3], al
            //   0fb64104             | movzx               eax, byte ptr [ecx + 4]

        $sequence_11 = { 8b442410 8b148520cd4e00 8b442440 33148520c94e00 33149d20d14e00 33148d20d14e00 }
            // n = 6, score = 200
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]
            //   8b148520cd4e00       | mov                 edx, dword ptr [eax*4 + 0x4ecd20]
            //   8b442440             | mov                 eax, dword ptr [esp + 0x40]
            //   33148520c94e00       | xor                 edx, dword ptr [eax*4 + 0x4ec920]
            //   33149d20d14e00       | xor                 edx, dword ptr [ebx*4 + 0x4ed120]
            //   33148d20d14e00       | xor                 edx, dword ptr [ecx*4 + 0x4ed120]

        $sequence_12 = { 83c40c 33c0 5b 5e 5f 5d }
            // n = 6, score = 200
            //   83c40c               | add                 esp, 0xc
            //   33c0                 | xor                 eax, eax
            //   5b                   | pop                 ebx
            //   5e                   | pop                 esi
            //   5f                   | pop                 edi
            //   5d                   | pop                 ebp

        $sequence_13 = { 0002 7408 00f7 7308 }
            // n = 4, score = 200
            //   0002                 | add                 byte ptr [edx], al
            //   7408                 | je                  0xa
            //   00f7                 | add                 bh, dh
            //   7308                 | jae                 0xa

        $sequence_14 = { 7524 3bfb 7409 57 e8???????? 83c404 }
            // n = 6, score = 200
            //   7524                 | jne                 0x26
            //   3bfb                 | cmp                 edi, ebx
            //   7409                 | je                  0xb
            //   57                   | push                edi
            //   e8????????           |                     
            //   83c404               | add                 esp, 4

        $sequence_15 = { 000b 8605???????? 007885 0500788605 }
            // n = 4, score = 200
            //   000b                 | add                 byte ptr [ebx], cl
            //   8605????????         |                     
            //   007885               | add                 byte ptr [eax - 0x7b], bh
            //   0500788605           | add                 eax, 0x5867800

    condition:
        7 of them and filesize < 6578176
}
Download all Yara Rules