[ MALWARE MUTEX INTELLIGENCE DATABASE ]

 ███████╗██╗   ██╗██╗██╗         ███╗   ███╗██╗   ██╗████████╗███████╗██╗  ██╗
 ██╔════╝██║   ██║██║██║         ████╗ ████║██║   ██║╚══██╔══╝██╔════╝╚██╗██╔╝
█████╗  ██║   ██║██║██║         ██╔████╔██║██║   ██║   ██║   █████╗   ╚███╔╝
██╔══╝  ╚██╗ ██╔╝██║██║         ██║╚██╔╝██║██║   ██║   ██║   ██╔══╝   ██╔██╗
 ███████╗ ╚████╔╝ ██║███████╗    ██║ ╚═╝ ██║╚██████╔╝   ██║   ███████╗██╔╝ ██╗
 ╚══════╝  ╚═══╝  ╚═╝╚══════╝    ╚═╝     ╚═╝ ╚═════╝    ╚═╝   ╚══════╝╚═╝  ╚═╝

Advanced Malware Analysis & Threat Intelligence

06:17:12

⚠

TeslaCrypt

ransomware5 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

TeslaCrypt

CATEGORY:

RANSOMWARE

DESCRIPTION:

TeslaCrypt is a now-defunct ransomware family that was active between 2015 and 2016. Initially targeting gamers by encrypting game-related files, it later broadened its scope. The operators eventually released the master decryption key.

ALIASES:

Tescrypt

TAGS:

file_encryptiongamersdefunct

[MUTEX_SIGNATURES](5)

[MUTEX_01]

8765-123rvr4

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://blog.checkpoint.com/wp-content/uploads/2016/05/Tesla-crypt-whitepaper_V3.pdf

[MUTEX_02]

2134-1234-1324-2134-1324-2134

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/

[MUTEX_03]

System1230123

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.secureworks.com/research/teslacrypt-ransomware-threat-analysis

[MUTEX_04]

dslhufdks3

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.secureworks.com/research/teslacrypt-ransomware-threat-analysis

[MUTEX_05]

9_9_9_9

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Tescrypt.R

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠TeslaCrypt

FIRST_OBSERVED:

2015

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:5

THREAT_ACTORS:1

ALIASES:1

TAGS:3

CATEGORY:RANSOMWARE

Malware profile loaded successfully