Latest Tesla Crypt Ransomware Borrows Code From Carberp Trojan
Summary: Unit 42 researchers found that the newest TeslaCrypt variant, introduced in late September, borrows string obfuscation and dynamic library/function loading code from the Carberp banking Trojan, whose source code was posted for sale on an underground Russian forum in mid-2013 and later leaked publicly. The strings are encrypted with the RC2 algorithm using a static key of 'sdflk35jghs', and the initialization vector is generated by removing the first and last 4 characters, not counting base64 padding.
Why it matters: Carberp's leaked source is now free for any author to copy, and TeslaCrypt's reuse of it may cut both ways: the same widely known code that slows static analysis can also make detection easier for security software.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026