Infection, Self-reproduction and Overinfection in Ransomware: The Case of TeslaCrypt

Security experts observed between 2015 and 2017 an exponential increase in the number of advanced threats via ransomware, They confirm that ransomware continues to make organizations suffer. This situation is announced in SophosLabs malware forecast 2018 which mentioned that the history of 2016/2017 is a revolution of ransomware. For Kaspersky this situation will not be different in 2018, ransomware will remain king and its destructive attacks will continue to rise, leveraging its status as the most visible type of cyberwarfare. In this work, we present a model of infection, self-reproduction and overinfection in a particular ransomware, it is TeslaCrypt in its version 3.1. We describe these concepts and discuss some indicators for TeslaCrypt and other ransomware detection.