User Description:
TeslaCrypt is a file-encrypting ransomware program that is designed for all Windows versions, including Windows Vista, Windows XP, Windows 7 and Windows 8. This program was released for the first time towards the end of February 2015. TeslaCrypt infects your computer and search for data files to encrypt. When all files that contain data on your computer are infected, an application will be displayed that gives information on how to recover your files. The instructions will include a link that connects to a TOR decryption service website. This site will give you information about the current ransom amount and the number of files encrypted, and the method you can use to make payment so that your files can be released. The average ransom is at $500. It is payable in Bitcoins. Each victim will have a unique Bitcoin address. After TeslaCrypt is installed on your computer , it will create an executable with a random label in the folder %AppData%. The executable is launched, and it begins to look through your drive letters on your computer for files to encrypt. It attaches an extension to the name of the file, and then encrypts any supported data files it discovers. This name is based on the variant that has affected your computer. The program is now using different file extensions to encrypt encrypted files with the release of new versions of TeslaCrypt. Currently, TeslaCrypt uses the following extensions: .ccc, .abc, .aaa, .zzz, .xyz, .exx, .ezz and .ecc. Minecraft servers There is a possibility that you could use the TeslaDecoder tool to decrypt your encrypted files free of cost. It's dependent on which version of TeslaCrypt is affected. You should be aware that TeslaCrypt will look through all drive letters on your computer to locate files to encrypt. It includes network shares, DropBox mappings, and removable drives. It only targets network shares data files in the event that the network share has been marked as a drive letter on your computer. The ransomware won't encode files on network shares if you don't have the network share mapped as a drive letter. After it has finished scanning your computer, it will delete all Shadow Volume Copies. This prevents you from restoring affected files. The title of the application displayed after encryption of your PC shows the version of the ransomware. How can your computer be infected with TeslaCrypt TeslaCrypt infects computers when a user visits a hacked website that runs an exploit kit and whose system is running outdated software. Hackers hack websites to distribute the malware. An exploit kit is a software program that they install. This tool exploits weaknesses in the programs on your computer. Acrobat Reader and Java are just a few of the programs that have vulnerabilities. If the exploit tool succeeds in exploiting the weaknesses on your computer, it then installs and launches TeslaCrypt without your knowledge. Therefore, you should ensure that your Windows and other installed programs are up-to-date. It protects your computer from potential weaknesses that could lead to infection by TeslaCrypt. The ransomware was the first to actively attack data files that are used by PC video games. It targets game files from games like MineCraft, Steam, World of Tanks, League of Legends and Half-life 2. Diablo, Fallout 3 Skyrim, Dragon Age Dragon Age, Call of Duty and RPG Maker are just a few of the many games it targets. It has, however, not been ascertained whether game targets mean increased revenue for developers of this malware. Versions of TeslaCrypt and the file extensions associated with it. TeslaCrypt is constantly updated to incorporate new file extensions and encryption methods. The first version encrypts files with the extension .ecc. In this instance encrypted files aren't paired with data files. TeslaDecoder can also be used to recover the original encryption key. If the decryption keys were zeroed out and the key was found to be partial in key.dat it is possible. You can also find the Tesla request directly to the server along with the decryption keys. There is another version with encrypted extensions for files of .ecc and .ezz. One cannot recover the original decryption key without having the author's private key if the decryption was zeroed out. The encrypted files can't be coupled with the data files. The Tesla request can be sent to the server using the encryption key. The original keys to decrypt the versions with extensions file names.ezz or.exx cannot be recovered without the authors private key. If the decryption secret key was zeroed out, it won't be possible to recover the keys used to decrypt. Minecraft servers Files encrypted with the extension .exx are associated with data files. The encryption key can also be got from the Tesla request to the server. Versions with encrypted files with extensions.ccc.,.abc..aaa..zzz, and.xyz do not make use of data files. The key for decryption cannot be saved on your computer. It is only decrypted when that the victim captures the key as it was being sent to the server. Decryption key can be retrieved from Tesla request to the server. This is not available for TeslaCrypt versions after v2.1.0. TeslaCrypt 4.0 is now available The authors have released TeslaCrypt4.0 sometime in March 2016. A quick review shows that the new version has fixed a flaw that corrupted files earlier than 4GB. It also comes with new ransom notes, and doesn't require encryption of files. It is difficult for users to learn about TeslaCryot or what occurred to their files as there is no extension. The ransom notes are used to create routes for victims. There are little established ways to decrypt files that have no extension, without a purchased decryption keys or Tesla's private key. If the attacker is able to capture the key while it was being transmitted to a server, the files can be decrypted.
