Telecrypt ransomware is a new malware that abuses the instant messaging service Telegram for command and control (C&C) communications.
Security experts from Kaspersky Lab have spotted a new Ransomware, called Telecrypt (Trojan-Ransom.Win32.Telecrypt), that abuses the Telegram instant messaging service for communications with command and control (C&C).
The Delphi-written Trojan, which is currently targeting only Russian users, it exploits the Telegram Messenger’s communication protocol to send a decryption key to the attackers.
Once infected a machine, Telecrypt ransomware generates a file encryption key and an infection ID. It creates a Telegram bot and exploits the Telegram API to send infection data to the C&C infrastructure.
Telecrypt notifies the successful infection to the C&C sending back data related to the compromised machine (i.e. Chat number, computer name, infection ID, and the seed for the encryption key).
“The Trojan then sends a request to the URL https://api.telegram.org/bot<token>/GetMe, where <token> the unique ID of the Telegram bot, created by the cybercriminals, is stored. According to the official API documentation, the method ‘getMe’ helps to check if a bot with the specified token exists and finds out basic information about it. The Trojan does not use the information about the bot that the server returns.” reads the analysis published by Kaspersky.
The Telecrypt ransomware then encrypts files with specific files in the local drives. The researchers noticed the ransomware sometimes uses the .Xcri extension for the encrypted files, otherwise it does not change it.
Once the encryption process is completed the Telecrypt Trojan downloads an executable file from a compromised WordPress website that displays the ransom note to the victims. The ransomware asks victims 5,000 RUB ($77) to recover the encrypted files, crooks accept payment via Qiwi or Yandex Money.
“Then the Trojan downloads the extra module Xhelp.exe (URL: http://***.ru/wp-includes/random_compat/Xhelp.exe) from a compromised site created using WordPress, and launches it. This module, called “Informer” (‘Информатор’ in the original Russian) by the cybercriminals, has a graphical interface and informs the victim about what has happened, and puts forward the ransom demand. The ransom is 5,000 RUB which is accepted via Qiwi or Yandex.Money payment methods.” continues the report published by Kaspersky.
The ransom page also allows victims to communicate with crooks by abusing the Telegram service.
Experts explained that the Telecrypt ransomware is not complex, for this reason, Kaspersky is working to crack it.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.