Telecrypt ransomware abuses Telegram Messenger’s communication protocol

Telecrypt ransomware is a new malware that abuses the instant messaging service Telegram for command and control (C&C) communications.

Security experts from Kaspersky Lab have spotted a new Ransomware, called Telecrypt (Trojan-Ransom.Win32.Telecrypt), that abuses the Telegram instant messaging service for communications with command and control (C&C).

The Delphi-written Trojan, which is currently targeting only Russian users, it exploits the Telegram Messenger’s communication protocol to send a decryption key to the attackers.

Once infected a machine, Telecrypt ransomware generates a file encryption key and an infection ID. It creates a Telegram bot and exploits the Telegram API to send infection data to the C&C infrastructure.

Telecrypt notifies the successful infection to the C&C sending back data related to the compromised machine (i.e. Chat number, computer name, infection ID, and the seed for the encryption key).

“The Trojan then sends a request to the URL https://api.telegram.org/bot<token>/GetMe, where <token> the unique ID of the Telegram bot, created by the cybercriminals, is stored. According to the official API documentation, the method ‘getMe’ helps to check if a bot with the specified token exists and finds out basic information about it. The Trojan does not use the information about the bot that the server returns.” reads the analysis published by Kaspersky.

The Telecrypt ransomware then encrypts files with specific files in the local drives. The researchers noticed the ransomware sometimes uses the .Xcri extension for the encrypted files, otherwise it does not change it.

Once the encryption process is completed the Telecrypt Trojan downloads an executable file from a compromised WordPress website that displays the ransom note to the victims. The ransomware asks victims 5,000 RUB ($77) to recover the encrypted files, crooks accept payment via Qiwi or Yandex Money.

“Then the Trojan downloads the extra module Xhelp.exe (URL: http://***.ru/wp-includes/random_compat/Xhelp.exe) from a compromised site created using WordPress, and launches it. This module, called “Informer” (‘Информатор’ in the original Russian) by the cybercriminals, has a graphical interface and informs the victim about what has happened, and puts forward the ransom demand. The ransom is 5,000 RUB which is accepted via Qiwi or Yandex.Money payment methods.” continues the report published by Kaspersky.

The ransom page also allows victims to communicate with crooks by abusing the Telegram service.

Experts explained that the Telecrypt ransomware is not complex, for this reason, Kaspersky is working to crack it.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Telecrypt ransomware, Telegram)