Notes

History and Evolution of TeslaCrypt Ransomware Virus

TeslaCrypt is a ransomware that encrypts files. It is a program designed for all Windows versions including Windows Vista, Windows XP, Windows 7 and Windows 8. The program was released for the first time at the end of February 2015. TeslaCrypt infects your computer and search for data files to encrypt.



When all data files on your computer have been infected, a program will be displayed that provides information on how to recover your files. The instructions will include a link that will direct you to a decryption site. The site will provide details about the current ransom amount and the number of files encrypted and how you can make payment so that your files are released. The ransom usually starts at $500. It is payable through Bitcoins. Each customer will have a unique Bitcoin address.



Once TeslaCrypt is installed on your computer, it generates an executable that is randomly labeled in the %AppData% directory. The executable starts and examines your drive letters to find files that can be encrypted. It adds an extension to the name of each supported data file it locates. The name is derived from the version that is affecting your computer. The program is now using different file extensions to encrypt encrypted files, with the release of the latest versions of TeslaCrypt. TeslaCrypt currently employs the following extensions to encrypted files:.cccc..abc..aaa..zzz..xyz. There is a possibility that you could make use of the TeslaDecoder tool to decrypt your encrypted files for free of cost. It depends on which version of TeslaCrypt is affected.



TeslaCrypt scans all drive letters on your computer to locate files that can be encrypted. It can scan network shares, DropBox mappings and removable drives. However, it only targets data files stored on network shares when you have the network share marked as a drive letter on your computer. The ransomware will not encode files on network shares if you don't have the network share marked as drive letter. After scanning your computer it will erase all Shadow Volume Copies. The ransomware does this to prevent you from restoring the affected files. The version of the ransomware is indicated by the application title that appears after encryption.



How TeslaCrypt infects your computer



TeslaCrypt infects computers if the user visits a compromised website that is equipped with an exploit kit and old programs. Developers hack websites to distribute this malware. They install a specific software program dubbed an exploit kit. This tool exploits weaknesses in your computer's programs. Some of the programs with vulnerabilities are usually exploited include Windows, Acrobat Reader, Adobe Flash and Java. Once the exploit kit is successful in exploiting the weaknesses on your computer, it then installs and starts TeslaCrypt without your knowledge.



Therefore, you should make sure that your Windows and other installed programs are up-to-date. This will help you avoid possible vulnerabilities that could lead to infection of your computer with TeslaCrypt.



This ransom ware was the first of its kind to target data files utilized by PC video games. It targets game files for games such as MineCraft, Steam, World of Tanks, League of Legends, Half-life 2. Diablo, Fallout 3, Skyrim, Dragon Age, Call of Duty, RPG Maker and many more. Minecraftservers However, it has not been determined if games targeting gamers increase the revenue of the malware developers.



Versions of TeslaCrypt, and the file extensions that go with it.



TeslaCrypt is updated frequently to incorporate new encryption techniques and file extensions. The initial version encrypts files that include the extension.ecc. The encrypted files, in this instance are not linked to the data files. TeslaDecoder can also be used to recover the original decryption key. If the decryption keys were zeroed out, and an incomplete key was discovered in key.dat it's possible. The decryption key can also be found the Tesla request to the server.



There is another version with encrypted extension of files like .ecc and .ezz. If the encryption key was not zeroed out, one cannot retrieve the original key. The encrypted files are not associated with the data file. The Tesla request can be sent to the server using the decryption key.



For the version that has an extension file names .ezz and .exx The original decryption key cannot be obtained without the authors' private key, if the decryption key was zeroed out. The encrypted files with the extension.exx are able to be linked with data files. Decryption key can also be got from the Tesla request to the server.



Versions that have encrypted file extensions.ccc or.abc do not utilize data files. The key to decrypt cannot be saved on your computer. It is only decrypted if the victim records the key while it is being transmitted to the server. The key to decrypt can be retrieved from Tesla request to the server. This is not possible for TeslaCrypt versions after v2.1.0.



Release of TeslaCrypt 4.0



Recently, the authors released TeslaCrypt 4.0 sometime in March 2016. A quick analysis shows that the new version has fixed a flaw that had previously caused corruption of files larger than 4GB. It also contains new ransom notes, and doesn't require encryption files to be encrypted. It is difficult for users to find out about TeslaCryot or what happened to their files because there is no extension. The ransom notes are used to create routes for victims. It is not possible to decrypt files without an extension without a key purchased or Tesla's personal key. If the user takes the key as it was being transmitted to a server and the files are decrypted.


Here's my website: https://minecraftservers.cc/