SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tflower (Back to overview)

TFlower


TFlower is a new ransomware targeting mostly corporate networks discovered in August, 2019. It is reportedly installed on networks by attackers after they gain access via RDP. TFlower displays a console showing activity being performed by the ransomware when it encrypts a machine, further indicating that this ransomware is triggered by the attacker post compromise, similar to Samsam/Samas in terms of TTP. Once encryption is started, the ransomware will conduct a status report to an apparently hard-coded C2. Shadow copies are deleted and the Windows 10 repair environment is disabled by this ransomware. This malware also will terminate any running Outlook.exe process so that the mail files can be encrypted. This ransomware does not add an extention to encrypted files, but prepends the marker "*tflower" and what may be the encrypted encryption key for the file to each affected file. Once encryption is completed, another status report is sent to the C2 server.

References
2021-03-03SYGNIAAmitai Ben Shushan, Noam Lifshitz, Amnon Kushnir, Martin Korman, Boaz Wasserman
@online{shushan:20210303:lazarus:60339a7, author = {Amitai Ben Shushan and Noam Lifshitz and Amnon Kushnir and Martin Korman and Boaz Wasserman}, title = {{Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware}}, date = {2021-03-03}, organization = {SYGNIA}, url = {https://www.sygnia.co/mata-framework}, language = {English}, urldate = {2021-03-04} } Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware
Dacls Dacls Dacls TFlower
2019-09-20Canadian Centre for Cyber SecurityCanadian Centre for Cyber Security
@online{security:20190920:tflower:90d959d, author = {Canadian Centre for Cyber Security}, title = {{TFlower Ransomware Campaign}}, date = {2019-09-20}, organization = {Canadian Centre for Cyber Security}, url = {https://cyber.gc.ca/en/alerts/tflower-ransomware-campaign}, language = {English}, urldate = {2020-01-10} } TFlower Ransomware Campaign
TFlower
2019-09-17Bleeping ComputerLawrence Abrams
@online{abrams:20190917:tflower:31c9072, author = {Lawrence Abrams}, title = {{TFlower Ransomware - The Latest Attack Targeting Businesses}}, date = {2019-09-17}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/tflower-ransomware-the-latest-attack-targeting-businesses/}, language = {English}, urldate = {2019-10-15} } TFlower Ransomware - The Latest Attack Targeting Businesses
TFlower
Yara Rules
[TLP:WHITE] win_tflower_auto (20210616 | Detects win.tflower.)
rule win_tflower_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.tflower."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tflower"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0001 0200 0103 0303 }
            // n = 4, score = 200
            //   0001                 | add                 byte ptr [ecx], al
            //   0200                 | add                 al, byte ptr [eax]
            //   0103                 | add                 dword ptr [ebx], eax
            //   0303                 | add                 eax, dword ptr [ebx]

        $sequence_1 = { c705????????01000000 6a04 58 6bc000 c780144c500002000000 }
            // n = 5, score = 200
            //   c705????????01000000     |     
            //   6a04                 | push                4
            //   58                   | pop                 eax
            //   6bc000               | imul                eax, eax, 0
            //   c780144c500002000000     | mov    dword ptr [eax + 0x504c14], 2

        $sequence_2 = { 77c5 ff248557984000 8bce e8???????? eb45 834e28ff }
            // n = 6, score = 200
            //   77c5                 | ja                  0xffffffc7
            //   ff248557984000       | jmp                 dword ptr [eax*4 + 0x409857]
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   eb45                 | jmp                 0x47
            //   834e28ff             | or                  dword ptr [esi + 0x28], 0xffffffff

        $sequence_3 = { 33542448 33542438 8b1c8d20c94e00 33d3 }
            // n = 4, score = 200
            //   33542448             | xor                 edx, dword ptr [esp + 0x48]
            //   33542438             | xor                 edx, dword ptr [esp + 0x38]
            //   8b1c8d20c94e00       | mov                 ebx, dword ptr [ecx*4 + 0x4ec920]
            //   33d3                 | xor                 edx, ebx

        $sequence_4 = { 001a 0c05 003c0c 05004e0c05 }
            // n = 4, score = 200
            //   001a                 | add                 byte ptr [edx], bl
            //   0c05                 | or                  al, 5
            //   003c0c               | add                 byte ptr [esp + ecx], bh
            //   05004e0c05           | add                 eax, 0x50c4e00

        $sequence_5 = { 8b442428 c1e810 0fb6c0 0fb68820f94e00 }
            // n = 4, score = 200
            //   8b442428             | mov                 eax, dword ptr [esp + 0x28]
            //   c1e810               | shr                 eax, 0x10
            //   0fb6c0               | movzx               eax, al
            //   0fb68820f94e00       | movzx               ecx, byte ptr [eax + 0x4ef920]

        $sequence_6 = { 000b 8605???????? 007885 0500788605 }
            // n = 4, score = 200
            //   000b                 | add                 byte ptr [ebx], cl
            //   8605????????         |                     
            //   007885               | add                 byte ptr [eax - 0x7b], bh
            //   0500788605           | add                 eax, 0x5867800

        $sequence_7 = { 0008 7408 0002 7408 }
            // n = 4, score = 200
            //   0008                 | add                 byte ptr [eax], cl
            //   7408                 | je                  0xa
            //   0002                 | add                 byte ptr [edx], al
            //   7408                 | je                  0xa

        $sequence_8 = { 0010 740b 0021 740b }
            // n = 4, score = 200
            //   0010                 | add                 byte ptr [eax], dl
            //   740b                 | je                  0xd
            //   0021                 | add                 byte ptr [ecx], ah
            //   740b                 | je                  0xd

        $sequence_9 = { 0001 7708 00f3 7608 }
            // n = 4, score = 200
            //   0001                 | add                 byte ptr [ecx], al
            //   7708                 | ja                  0xa
            //   00f3                 | add                 bl, dh
            //   7608                 | jbe                 0xa

        $sequence_10 = { 68fd000000 8885fefeffff 8d85fffeffff 6a00 50 }
            // n = 5, score = 200
            //   68fd000000           | push                0xfd
            //   8885fefeffff         | mov                 byte ptr [ebp - 0x102], al
            //   8d85fffeffff         | lea                 eax, dword ptr [ebp - 0x101]
            //   6a00                 | push                0
            //   50                   | push                eax

        $sequence_11 = { 000f 7708 0001 7708 }
            // n = 4, score = 200
            //   000f                 | add                 byte ptr [edi], cl
            //   7708                 | ja                  0xa
            //   0001                 | add                 byte ptr [ecx], al
            //   7708                 | ja                  0xa

        $sequence_12 = { 0f843d010000 8b0495ac7c4b00 8985ccf6ffff 85c0 }
            // n = 4, score = 200
            //   0f843d010000         | je                  0x143
            //   8b0495ac7c4b00       | mov                 eax, dword ptr [edx*4 + 0x4b7cac]
            //   8985ccf6ffff         | mov                 dword ptr [ebp - 0x934], eax
            //   85c0                 | test                eax, eax

        $sequence_13 = { 0002 7408 00f7 7308 }
            // n = 4, score = 200
            //   0002                 | add                 byte ptr [edx], al
            //   7408                 | je                  0xa
            //   00f7                 | add                 bh, dh
            //   7308                 | jae                 0xa

        $sequence_14 = { 89842408010000 8b442430 8b0c8d20c94e00 8b048520d54e00 3304ad20d14e00 3304bd20cd4e00 }
            // n = 6, score = 200
            //   89842408010000       | mov                 dword ptr [esp + 0x108], eax
            //   8b442430             | mov                 eax, dword ptr [esp + 0x30]
            //   8b0c8d20c94e00       | mov                 ecx, dword ptr [ecx*4 + 0x4ec920]
            //   8b048520d54e00       | mov                 eax, dword ptr [eax*4 + 0x4ed520]
            //   3304ad20d14e00       | xor                 eax, dword ptr [ebp*4 + 0x4ed120]
            //   3304bd20cd4e00       | xor                 eax, dword ptr [edi*4 + 0x4ecd20]

        $sequence_15 = { 8944242c e8???????? 6a00 6898010000 }
            // n = 4, score = 200
            //   8944242c             | mov                 dword ptr [esp + 0x2c], eax
            //   e8????????           |                     
            //   6a00                 | push                0
            //   6898010000           | push                0x198

    condition:
        7 of them and filesize < 6578176
}
Download all Yara Rules