Post cover image

October 15, 2026

BTLO: Network Analysis — Ransomware

Scenario: ABC Industries’ final tender document was encrypted by ransomware. You get a PCAP, the ransom note, and the encrypted file, and…

By Sushma

5 min read

Scenario: ABC Industries' final tender document was encrypted by ransomware. You get a PCAP, the ransom note, and the encrypted file, and your job is to recover the document. Tools: Wireshark, VirusTotal, Talos TeslaDecrypter (the one you just cloned).

Q1. What OS did the capture come from?

  1. Open the PCAP in Wireshark.
  2. Go to Statistics → Capture File Properties.
  3. Read the OS line in the capture details.

Answer: 32-bit Windows 7 Service Pack 1, build 7601

None None

Q2. What is the full URL the ransomware was downloaded from?

  1. Apply the display filter http.request.method == GET.
  2. Look for the request that fetches an executable.
  3. Right-click it and choose Follow → HTTP Stream to see the Host header and path together.

Answer: http://10.0.2.15:8000/safecrypt.exe

None

Q3. What is the ransomware executable's name?

It's the filename at the end of the URL from Q2.

Answer: safecrypt.exe

Q4. What is its MD5 hash?

  1. Go to File → Export Objects → HTTP.
  2. Select safecrypt.exe and click Save.
  3. Get the hash with md5sum safecrypt.exe, or upload the file to VirusTotal and read it from the Details tab.

Answer: 4a1d88603b1007825a9c6b36d1e5de44

None None None None None

VirusTotal VirusTotal

Q5. What is the name of the ransomware?

  1. Search the hash on VirusTotal.
  2. Check the detection names and the Community tab.

Answer: TeslaCrypt

None

VirusTotal VirusTotal

Q6. What encryption algorithm does the ransom note claim?

  1. Open help_recover_instructions.txt from the evidence folder.
  2. Read the algorithm mentioned in the note.

Answer: RSA-4096

The note's claim is a scare tactic. Per the TeslaDecrypter readme, TeslaCrypt actually encrypts files with AES-256, and EC is used for the key. That's why a decryptor is possible at all.

None None

Q7. Which domain starting with "d" is tied to the ransomware traffic?

  1. On the VirusTotal page for the sample, open the Behavior tab.
  2. Look at the contacted domains.
  3. Pick the one starting with "d". You can cross-check it in Wireshark with dns or http.host contains "dunya".

Answer: dunyamuzelerimuzesi.com

None

VirusTotal VirusTotal

Q8. Decrypt the tender document and submit the flag

The article only shows a screenshot here, so these steps are my reconstruction:

  1. Confirm the encrypted tender file's extension and header (file, xxd | head) to see that it's a TeslaCrypt-encrypted file.
  2. Run the Talos tool from your Release folder. Copy the encrypted file in next to the exe, or reference it as Z:\home\kali\... under Wine. Run wine TeslaDecrypter.exe with the help switch, or check TeslaDecrypterApp.cpp, to confirm the exact argument syntax before you run it.
  3. The tool picks the correct method for the TeslaCrypt version (factorization for 2.x, the leaked C&C key for 3.x/4.x), verifies the key, and writes out the decrypted document.
  4. Open the decrypted file and read the flag.

Answer: BTLO-T3nd3r-Fl@g

┌──(kali㉿kali)-[~/Downloads/BTLO Network Analysis - Ransomware/Challenge Files]
└─$ python3 -m venv venv

┌──(kali㉿kali)-[~/Downloads/BTLO Network Analysis - Ransomware/Challenge Files]
└─$ source venv/bin/activate

┌──(venv)─(kali㉿kali)-[~/Downloads/BTLO Network Analysis - Ransomware/Challenge Files]
└─$ pip install pycryptodome
Collecting pycryptodome
  Downloading pycryptodome-4.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl.metadata (5.8 kB)
Downloading pycryptodome-4.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl (2.5 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.5/2.5 MB 1.4 MB/s  0:00:01
Installing collected packages: pycryptodome
Successfully installed pycryptodome-4.0.0

┌──(venv)─(kali㉿kali)-[~/Downloads/BTLO Network Analysis - Ransomware/Challenge Files]
└─$ git clone https://github.com/Cisco-Talos/TeslaDecrypt.git
cd TeslaDecrypt
Cloning into 'TeslaDecrypt'...
remote: Enumerating objects: 269, done.
remote: Total 269 (delta 0), reused 0 (delta 0), pack-reused 269 (from 1)
Receiving objects: 100% (269/269), 1.40 MiB | 1.86 MiB/s, done.
Resolving deltas: 100% (122/122), done.

┌──(venv)─(kali㉿kali)-[~/Downloads/BTLO Network Analysis - Ransomware/Challenge Files/TeslaDecrypt]
└─$ ls
 AlphaCrypt.cpp     entrypoint.cpp   Release      stdafx.h                TeslaDecrypter.cpp   TeslaDecrypter.vcproj           'Version History.txt'
 AlphaCrypt.h       Log.cpp          res          targetver.h             TeslaDecrypter.h     TeslaDecrypter.vcxproj           warranty_disclaimer.txt
 EcFactorizer.cpp   Log.h            resource.h   TeslaDecrypterApp.cpp   TeslaDecrypter.rc    TeslaDecrypter.vcxproj.filters
 EcFactorizer.h     readme.md        stdafx.cpp   TeslaDecrypterApp.h     TeslaDecrypter.sln   TeslaDecrypter_vs2015.sln

┌──(venv)─(kali㉿kali)-[~/Downloads/BTLO Network Analysis - Ransomware/Challenge Files/TeslaDecrypt]
└─$ wine TeslaDecrypter.exe

003c:err:service:process_send_start_message service L"Winedevice2" failed to start
^Z
zsh: suspended  wine TeslaDecrypter.exe

┌──(venv)─(kali㉿kali)-[~/Downloads/BTLO Network Analysis - Ransomware/Challenge Files/TeslaDecrypt]
└─$ cat readme.md
ls Release
less TeslaDecrypterApp.cpp
<h2>Talos Universal TeslaDecrypter</h2>
<h5>Version 1.0</h5>
An application able to decrypt all the files encrypted by all version of TeslaCrypt and AlphaCrypt:
<ul>
   <li>TeslaCrypt 0.x - Encrypts files using an AES-256 CBC algorithm</li>
   <li>AlphaCrypt 0.x - Encrypts files using AES-256 and encrypts the key with EC</li>
   <li>TeslaCrypt 2.x - Same as before, but uses EC to create a weak Recovery key. The application is able to use factorization to recover the victim's global private key.</li>
   <li>TeslaCrypt 3 & 4 - The last ultimate versions. We are able to decrypt their files because we have sink-holed the C&C server EC private key.
</ul>
<br>
<h5>Compiling</h5>
To proper compile the code you should have OpenSsl installed in a particular root directory (like "C:\OpenSsl"), and an environment variable named "openssldir" that points to it.<br>
You can find an handy pre-compiled OpenSsl package here:<br>
<a href="http://www.npcglib.org/~stathis/blog/precompiled-openssl/">www.npcglib.org/~stathis/blog/precompiled-openssl/</a><br>
The code has been tested with 2 environments: Visual Studio 2008 and Visual Studio 2015.<br>
To proper allow the factorization to run, you should add 2 Msieve files inside the compiled application path:
<ul>
  <li>msieve152.exe</li>
  <li>pthreadGC2.dll</li>
</ul>
Those files have been already included in this repository. You can find a copy of Msieve here:<br>
<a href="https://sourceforge.net/projects/msieve/">https://sourceforge.net/projects/msieve/</a><br>
<br>
<h5>Improvements</h5>
This application contains a lot of improvements and modifications in respect to TeslaDecrypter 0.2. Here is a complete list:
<ul>
  <li>Re-designed the decryption algorithm (now it properly deals with big files and uses less memory)</li>
  <li>Added support for the Factorization algorithm (TeslaCrypt 2.x) able to reconstruct the victim's private key (Yes, written in plain C++ :-) and 50 times faster than its Python counterpart)</li>
  <li>An algorithm able to manage and launch Msieve, and parse its log file</li>
  <li>Added support for TeslaCrypt 3.x and 4.x</li>
  <li>Added key verification algorithms (TeslaCrypt 2.x/3/4) - In this way the Decryptor <u>can't produce</u> invalid files</li>
  <li>A powerful command line arguments</li>
  <li>Imported leaked TeslaCrypt 3.x/4 C&C private key </li>
</ul>
<br>
<br>
Last revision: 05/31/2016
msieve152.exe  pthreadGC2.dll  readme.html  TeslaDecrypter.exe  warranty_disclaimer.txt

┌──(venv)─(kali㉿kali)-[~/Downloads/BTLO Network Analysis - Ransomware/Challenge Files/TeslaDecrypt]
└─$ sudo apt install wine
cd Release
wine TeslaDecrypter.exe
[sudo] password for kali:
wine is already the newest version (10.0~repack-11).
The following packages were automatically installed and are no longer required:
  libntfs-3g89t64  libpython3.13-dev  libvidstab1.1  python3.13  python3.13-dev  python3.13-minimal  python3.13-tk  python3.13-venv  rpcsvc-proto
Use 'sudo apt autoremove' to remove them.

Summary:
  Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 1436
00ec:err:clipboard:convert_selection Timed out waiting for SelectionNotify event
00ec:err:clipboard:convert_selection Timed out waiting for SelectionNotify event

┌──(venv)─(kali㉿kali)-[~/…/BTLO Network Analysis - Ransomware/Challenge Files/TeslaDecrypt/Release]
└─$
wine TeslaDecrypter.exe
None None None 
BTLO-T3nd3r-Fl@g

Thanks for Reading:)