History And Development Of TeslaCrypt Ransomware The Virus
TeslaCrypt is a file encryption ransomware program that targets all Windows versions, including Windows Vista, Windows XP and Windows 7. This ransomware program was first released at the end of February 2015. TeslaCrypt is a virus that infects your computer and searches for data files to encrypt.
When all your data files have been infected, a program will be displayed. It will give you information on how to recover them. The instructions will contain the link to a TOR decryption service site. The site will provide you with information on the current ransom amount, how many files are encrypted, and how to make payment so your files can be released. The ransom amount typically starts at $500. It is payable in Bitcoins. Each victim will have a unique Bitcoin address.
Once TeslaCrypt is installed on your computer, it creates an executable with a random label within the %AppData% folder. The executable is launched and starts to scan the drive letters of your computer for files to encrypt. When it detects a supported data file it encrypts it and then adds a new extension to the name of the file. This name is derived from the variant that has affected your computer. The program now uses different extensions for files to encrypt encrypted files, with the release of new versions of TeslaCrypt. TeslaCrypt currently uses the following extensions for encrypted files:.cccc..abc..aaa..zzz..xyz. There is a possibility that you could make use of the TeslaDecoder tool to decrypt your encrypted files free of cost. It is, of course, dependent on the version of TeslaCrypt that has infected your files.
You should be aware that TeslaCrypt will look through all drive letters on your computer to identify files to secure. It can be used to encrypt network shares, DropBox mappings, and removable drives. It only targets network share data files when the network share is marked as a drive letter on your computer. If you don't have mapped the network share as a drive-letter, the ransomware won't encode the files on the network share. After scanning your computer it will delete all Shadow Volume Copies. This is done to stop you from restoring the affected files. The version of the ransomware is identified by the application title that appears after encryption.
How can your computer be infected with TeslaCrypt
TeslaCrypt can infect computers when the user goes to a hacker site that has an exploit kit and old software. To distribute this malware hackers hack websites. An exploit kit is a special software program that they install. This kit seeks to exploit weaknesses in the programs of your computer. Some of the programs with vulnerabilities are commonly exploited include Windows, Acrobat Reader, Adobe Flash and Java. Once the exploit kit succeeds in exploiting weaknesses on your computer, it will automatically installs and starts TeslaCrypt without your knowledge.
You should, therefore, ensure that your Windows and other programs installed are up-to-date. It will protect you from possible security issues that could lead to infection of your computer with TeslaCrypt.
This ransom ware was the first of its kind to target data files used by PC video games actively. It targets game files from games such as MineCraft, Steam, World of Tanks, League of Legends Half-life 2. Diablo, Fallout 3, Skyrim, Dragon Age, Call of Duty, RPG Maker, and many others. However, it has not been established if the game's targets lead to increased revenue for the malware developers.
Versions of TeslaCrypt and the file extensions associated with it.
TeslaCrypt is frequently updated to include new file extensions and encryption methods. The initial version encrypts files that include the extension.ecc. The encrypted files, in this instance are not associated with the data files. The TeslaDecoder can also be used to recover the encryption key that was originally used. If the keys used to decrypt were zeroed out and a partial key was found in key.dat it's possible. The decryption key can also be found the Tesla request to the server.
There is a different version that comes with encrypted extension of files like .ecc and .ezz. It is impossible to recover the original decryption key without having the ransomware's authors' private key in the event that the encryption was zeroed out. The encrypted files are also not paired with the data file. The encryption key can be downloaded from the Tesla request that was sent to the server.
The original keys to decrypt the versions that have extensions file names.ezz or.exx cannot be recovered without the author's private key. If the secret key used to decrypt the data was zeroed out, it will not be possible to retrieve the keys used to decrypt. Files encrypted with the extension.exx can be joined with data files. The encryption key can also be got from the Tesla request to the server.
The version that has encrypted extensions for files .ccc, .abc, .aaa, .zzz and .xyz does not make use of data files and the decryption key is not stored on your computer. It is only decrypted when the victim is able to capture the key while it was being transmitted to the server. The key to decrypt can be retrieved from Tesla request to the server. This is not available for TeslaCrypt versions prior to v2.1.0.
Release of TeslaCrypt 4.0
The authors recently released TeslaCrypt4.0 sometime in March 2016. The new version has been updated to fix an issue that caused damaged files that were larger than 4GB. Minecraft servers contains new ransom notes and does not require encryption of files. The absence of an extension makes it difficult for users to find out the existence of TeslaCryot and what happened to their files. The ransom notes are used to create paths for victims. It is impossible to decrypt files with no extension without a key purchased or Tesla's personal key. If the user captures the key while it was being transmitted to servers, the files can be decrypted.