TFlower ransomware decryption and removal

A rampant progress of the targeted crypto-viral epidemic continues to spawn new strains, with TFlower ransomware being the latest addition to the e-crime trend.

1. What is the TFlower ransomware?
2. TFlower ransomware automated removal and data recovery
3. TFlower ransomware manual removal and file recovery
4. Ransomware Prevention Tips

What is the TFlower ransomware?

The ups and downs of file-encrypting ransomware as a phenomenon proved to be much more dramatic than fluctuations in the distribution of any other malware category. Having almost vanished from the cybercrime landscape two years ago, the plague has gone through groundbreaking metamorphosis, only to re-emerge in a novel shape with higher quality and new infection vectors at its core. As a result, ubiquitous ransom Trojans indiscriminately hunting both small and large prey are no longer the top security concern now in 2019. They have been superseded by samples that zero in on corporate networks, healthcare organizations, and governmental branches around the world.

This shift gave rise to nasties like the TFlower ransomware. Originally discovered in late July, this specimen didn’t seem to be a big deal as it wasn’t backed by massive propagation back then. A few months later, things started getting hot due to a growing number of incident reports from the enterprise sector involving this lineage. The wakeup call in all these scenarios is that data becomes inaccessible and a ransom message named !_Notice_!.txt is sprinkled throughout the infected hosts.

Unlike many other widespread ransomware samples, TFlower doesn’t modify filenames. It does encrypt the files proper, though. This way, the victim cannot open or edit their most valuable data and is literally coerced to resort to the above-mentioned rescue note for recovery steps. Instead of tweaking hostage files on the outside, this infection unleashes a peculiar quirk that allowed researchers to dub it this way. If an encrypted item is put to analysis with a hex editor, its inner binary structure turns out to have a *tflower prefix followed by a scrambled encryption key uniquely generated for this file. However, the vast majority of victims won’t notice this deep-level change. What actually strikes the eye is that ostensibly normal-looking files suddenly get locked down beyond regular restoration. It comes as no surprise that the ransom note may instill some faint hope in the desperate IT personnel and executives of a raided organization. However, even a quick peek into the !_Notice_!.txt document dropped by TFlower ransomware is enough to dispel this illusion.

The fundamentals of remedying the situation as offered by the extortionists boil down to an uncomforting “deal” explicated in the ransom note that starts with a scary phrase “Important notice that is urgent and true”. Be advised that there are several known editions of this document that differ in terms of the details listed, including the payment site address, the Bitcoin ransom size, and the contact info to reach out to the perpetrators. The discrepancy could mean that the TFlower virus is being distributed by several cybercriminal groups at the same time. With that said, the tone and general warning text are identical across all cases. The message goes on to say:

“Dear Sir/Ma,

Sorry to inform you but many files of your company has [sic] just been encrypted with a strong key.
This simply means that you will not be able to use your files until it is [sic] decrypted by the same key used in encrypting it.

To get the decrypt tool for your company, you have to make payment to us so as to recover your files.”

The crooks additionally claim to test-decrypt one file free of charge, with the caveat that it shouldn’t contain any valuable information. To proceed with recovery, the victim is supposed to contact the attackers at one of the following email addresses: flower.harris@protonmail.com, flower.harris@tutanota.com, or flowerboard@torguard.tg. In response to the message, the TFlower ransomware operators will send back a URL of the personal payment page, which is hosted at Tor (The Onion Router) anonymity network. In some cases, the address is indicated in the rescue manual proper so that the victim needn’t engage in the shady email correspondence unless they have additional questions or want to negotiate with the malefactors.

The resulting .onion resource is named “Flower” and provides the essentials of the ransom payment process. In particular, it mentions the receiving Bitcoin address, current payment status, an area to upload a test file for free decryption, and of course the amount of the ransom. The latter depends on the scope of the infected enterprise network and therefore varies. It can range from 15 BTC to as much as 70 BTC – either way, the sum is huge regardless of the affected business. Furthermore, even if a company happens to opt for this horrific covenant, there is absolutely no guarantee that the attackers will ever carry through with their promise to provide a viable automatic decryptor along with the secret decryption key.

At this point, those infected probably contemplate over what went wrong and allowed the breach to take place. The only confirmed entry point the TFlower ransomware distributors are leveraging is all about compromising remote desktop services. This tactic is one of the present-day cyber extortionists’ favorites, especially when it comes to incursions against large computer networks. The felons employ malicious toolkits available on the Dark Web to scan a targeted corporate environment for hosts using weak RDP credentials. If found, these connections are exploited to deposit the ransom Trojan onto a vulnerable machine manually. Then, the malicious actors launch PsExec or similar utility to pollute other computers on the same network.

If there are no recent data backups stored on unaffected hardware or in a properly protected cloud, the odds of reinstating the encrypted data without coughing up the unthinkable ransom are fairly low. Are the alternative recovery methods worth trying under the circumstances? They certainly are, but the TFlower ransomware should be completely removed from a poisoned network prior to any further fixes. See the tutorial below to learn how to get rid of the infection and attempt to get the data back.

TFlower ransomware automated removal and data recovery

When faced with ransomware like TFlower, one of the best shortcuts in terms of removal is to use Combo Cleaner, a lightweight and incredibly effective application with PC security and optimization features under the hood. It detects and thoroughly deletes threats while giving you insights into the overall health of your computer.

This program’s protection power spans modules that forestall all known types of malware, including ransomware and browser hijackers, and take your online security to the next level by blocking phishing sites and other suspicious web pages. Follow these simple steps to eliminate the infection for good:

1. Download Combo Cleaner installer.

Download TFlower remover

^{Combo Cleaner scans your PC with no strings attached, but you’ll have to buy its fully functional version to remove the threats it detects. The disk optimization tools that find large files and duplicates are free to use.}

2. Open the CCSetup.exe file to get started. Several subsequent screens will allow you to make initial customizations so that the program works exactly as you need from the get-go.

3. The installation will be followed by an update of malware signatures. Once this process is through, click the Start Scan button in the left-hand sidebar.

4. Combo Cleaner will then check system locations that are most often polluted by Windows malware. The first scan can take a while to finish.

5. Combo Cleaner will display a system tray notification as soon as the scan is over. Click the Resolve found threats button to view the results.

6. The scan summary shows the names and types of the detected threats as well as their statuses and locations. Click the Remove all threats button and follow further on-screen prompts to get rid of these items.

Data recovery toolkit to the rescue

Some strains of ransomware are known to delete the original files after the encryption routine has been completed. As hostile as this activity appears, it can play into your hands. There are applications designed to revive the information that was obliterated because of malfunctioning hardware or due to accidental removal. The tool called Stellar Data Recovery features this type of a capability and therefore it can be applied in ransom attack scenarios to at least get the most important files back. So use the app to get an idea of what data can be restored and let it do the recovery job. Here is a step-by-step walkthrough:

1. Download and install Stellar Data Recovery.

Download Stellar Data Recovery

2. Open the application, select the types of recoverable files to look for, and click Next.

3. Choose the areas you want the tool to recover from and click the Scan button.

4. Having scanned the specified locations, the program will display a notification about the total amount of recoverable data. Close the dialog and click the Recover button. This will hopefully help you get some of your valuable files back.

TFlower ransomware manual removal and file recovery

Some ransomware strains terminate themselves after completing the encryption job on a computer, but some don’t. Furthermore, the TFlower virus may prevent victims from using popular antimalware tools in order to stay on board for as long as possible. Under the circumstances, it may be necessary to utilize the Safe Mode with Networking or System Restore functionality.

Be advised that even after the ransomware is removed, files will still be encrypted and inaccessible. The malicious code cleanup part, however, is important because it keeps a relapse of the infection from occurring further on and eliminates all opportunistic malware.

Ways of non-ransom recovery of files encrypted by TFlower

Cracking the crypto used by this ransom Trojan is more of a science fiction thing rather than an attainable prospect for the masses. This is why the troubleshooting in predicaments of this sort is a matter of two approaches: one is to pay the ransom, which isn’t an option for many victims; and the other is to apply instruments that take advantage of the ransomware’s possible weaknesses. If the latter is your pick, the advice below is a must-try.

Ransomware Prevention Tips

To avoid TFlower ransomware and other file-encrypting infections in the future, follow several simple recommendations:

These techniques are certainly not a cure-all, but they will add an extra layer of ransomware protection to your security setup.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup. Another benefit of using the antimalware tool is that it will keep ransomware threats from intruding on your computer further on.

Download TFlower removal tool