Analysis of the tflower Ransomware
To thoroughly analyze a ransomware threat, analysts drove AVL Code with a single natural-language instruction, closing the loop from malicious sample to a complete analysis report.
Built with AVL Code + the Landi model
Overview
Facing a 1.37MB, unpacked 64-bit Windows tflower ransomware executable, analysts drove AVL Code with one natural-language instruction to reverse-engineer its PE structure and behavior in depth: reconstructing its OpenSSL-based AES-256-CBC file-encryption scheme (an embedded RSA public key suggests a possible RSA+AES hybrid scheme), and identifying HTTP(S) C2 reporting (victim hostname and encryption status), a registry Run-key persistence, and system-recovery-destroying behavior (shadow-copy deletion, recovery disabling) — producing a report with a complete IOC list, extracted ransom-note text and contact details, and remediation advice, classified as Critical.
Key results
- Fully reverse-engineered the 1.37MB unpacked PE32+ ransomware sample, reconstructing its OpenSSL-based AES-256-CBC encryption scheme and identifying an embedded RSA public key suggesting a possible RSA+AES hybrid scheme
- Extracted a complete IOC list (4 file hashes, 1 C2 domain/URL, 2 ransom-contact emails, 1 registry persistence path)
- Identified multiple system-recovery-destroying behaviors (shadow-copy deletion, recovery and boot-repair disabling, recycle-bin emptying) and fully extracted the ransom-note text and contact details
- Classified it as ransomware targeting enterprise environments (HTTP(S) reporting of hostname and encryption status), producing a report with remediation advice, classified as Critical
Technical highlights
Practical value
Helps security operations rapidly identify and respond to ransomware threats, provides end-to-end guidance from detection to remediation, strengthens ransomware detection and handling, and effectively protects enterprise data assets from encryption extortion.
Artifacts
Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model