Notes

The Evolution and History of TeslaCrypt Ransomware Virus

TeslaCrypt is a ransomware that encrypts files. It is a program that is designed for all Windows versions including Windows Vista, Windows XP, Windows 7 and Windows 8. The program was launched in the first time around the close of February 2015. TeslaCrypt can infect your computer and search for data files to encrypt.



Once all data files on your computer have been affected, an application will be displayed with details on how to retrieve your files. The instructions will include an link that will direct you to a decryption site. This site will provide details about the current ransom amount and the number of files encrypted, and the method you can use to pay the ransom so that your files are released. The ransom amount typically starts at $500. It is payable in Bitcoins. There is a unique Bitcoin address for each victim.



After TeslaCrypt has been installed on your computer , it will generate a randomly-labeled executable in the folder named %AppData in the folder %AppData%. The executable launches and scans your computer's drive letters for files that can be encrypted. If it finds a compatible data file the file is encrypted and attaches an extension to the name of the file. The name is based on the version that affected your computer. The program is now using different extensions for files to encrypt encrypted files following the release of new versions of TeslaCrypt. TeslaCrypt currently uses the following extensions for encrypted files:.cccc..abc..aaa..zzz..xyz. You could use TeslaDecoder to decrypt encrypted files for free. It depends on which version of TeslaCrypt is infected.



TeslaCrypt searches for every drive letter on your computer to find files to encrypt. It can scan network shares, DropBox mappings and removable drives. It only targets network shares ' data files when the network share is mapped as a drive letters on your computer. The ransomware will not encrypt files on network shares if you don't have the network share mapped as a drive letter. Once it is done scanning your PC, it will erase all Shadow Volume Copies. This is done to prevent you from restoring affected files. The title of the program displayed after the encryption of your computer is the ransomware's version.



How does your computer get infected by TeslaCrypt



TeslaCrypt is a computer virus that can be infected if the user visits a compromised website that is equipped with an exploit kit and old software. To spread this malware hackers hack websites. An exploit kit is a special software program that they install. This tool aims to exploit vulnerabilities found in your computer's software. Some of the programs whose vulnerabilities are usually exploited include Windows, Acrobat Reader, Adobe Flash and Java. Once the exploit kit is successful in exploiting the weaknesses on your computer, it automatically installs and launches TeslaCrypt without your knowledge.



It is important to ensure that Windows and all other programs are up to date. It protects your computer from vulnerabilities that could cause infection by TeslaCrypt.



This ransom ware was the first to target data files used by PC video games. It targets game files from games like MineCraft, Steam, World of Tanks, League of Legends, Half-life 2. Diablo, Fallout 3 Skyrim, Dragon Age Dragon Age, Call of Duty and RPG Maker are just a handful of the many games it targets. It has, however, not been established whether game targets mean increased profits for the developers of this malware.



Versions of TeslaCrypt and related extensions to files



TeslaCrypt is regularly updated to include new file extensions and encryption techniques. The initial version encrypts files that contain the extension.ecc. In this scenario the encrypted files aren't coupled with data files. TeslaDecoder can also be used to recover the original decryption key. It's possible if the key used to decrypt was zeroed out and a partial key was discovered in key.dat. The key for decryption can be found the Tesla request to the server.



Another version is available with encrypted file extensions.ecc or.ezz. If the encryption key was not zeroed out, one cannot find the original key. The encrypted files can't be joined with the data files. The encryption key is derived from the Tesla request sent to the server.



The original keys to decrypt the versions with extensions file names.ezz or.exx cannot be recovered without the author's private key. If the secret key for decryption was zeroed out, it won't be possible to recover the original key. Files encrypted with the extension.exx can be paired with data files. You can also request a decryption key through the Tesla server.



The version that has encrypted extension files such as .ccc, .abc, .aaa, .zzz and .xyz does not use data files and the decryption key is not stored on your computer. It can only be decrypted in the event the victim captured the key while it was being sent to the server. You can retrieve the decryption key by contacting Tesla. It is not possible to do this for versions prior to TeslaCrypt v2.1.0.



The release of TeslaCrypt 4.0



The authors have released TeslaCrypt4.0 in March of 2016. A quick review shows that the new version fixes a glitch that corrupted files earlier than 4GB. It also contains new ransom notes and does not require encryption of encrypted files. The absence of an extension makes it hard for users to discover about TeslaCryot and what happened to their files. With the latest version, users will have to follow the path outlined in the ransom notes. It is not possible to decrypt files without an extension without a key purchased or Tesla's personal key. Minecraft servers The files can be decrypted if the victim has captured the key while it was being transmitted to the server during encryption.


Website: https://mpservers.net/minecraft-servers/