Rewterz Threat Alert – TZW Ransomware – Active IOCs

Severity

High

Analysis Summary

TZW ransomware is a type of malware that employs various tactics and techniques to infect systems and encrypt files for ransom. Here is a summary of the tactics and techniques commonly used by TZW ransomware: 

• Phishing and social engineering: TZW ransomware can be delivered through phishing emails or other social engineering tactics, such as disguised links or attachments.
• Exploit kits: TZW ransomware can be delivered through exploit kits, which exploit vulnerabilities in software to install malware on a target system. 
• File encryption: TZW ransomware uses strong encryption algorithms to encrypt files on an infected computer, making them inaccessible to the user. 
• Ransom demand: TZW ransomware typically leaves a ransom note on the infected computer, demanding payment in exchange for the decryption key. The ransom amount can vary and is typically requested in cryptocurrency. 
• Network propagation: TZW ransomware can spread within a network by leveraging known vulnerabilities or by using credentials stolen from infected machines. 
• File marker: TZW ransomware can leave a unique marker in the encrypted files, which can be used to identify the specific variant of TZW ransomware involved in an attack. 
• Evasion techniques: TZW ransomware can employ techniques to evade detection, such as using encryption to hide its communications or disabling security software on the infected computer. 

TZW ransomware is a persistent threat to organizations, as it can cause significant data loss and disruption to operations. To mitigate the risk of infection, it is important to implement strong security measures and be vigilant against potential threats. This can include implementing robust backup and recovery strategies, regularly updating software and security patches, and providing employee training to recognize and avoid phishing and social engineering attacks.

Impact

• File Encryption

Indicators of Compromise

MD5

• eae94abe9753634f79a91ecb4da7ff72
• 10daa4697b861d3dc45a0a03222ba132
• f1ab4f5cbf5fc72c4033699edadc4622

SHA-256

• 98e4a7b1d986cf70410dc14933dc2b3924056cb4cac52f0193cd3a93f58d6b07
• b1a4e443f19c4910ffff0ed565395a28a4a6329a241aef29c29765c0ef33ce4f
• c333a0afa8f9c38ff61d3618d8d3c7749e88cbba269c3345706898224da679dd

SHA-1

• 9a080cd497b8aa0006dc953bd9891155210c609c
• df2c4f580268ce9a57e0ffb815324779b5880c08
• 858f3f7f656397fcf43ac5ea13d6d4cbe7a5ca11

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.