Classification Trojan horse Subtype Cryptovirus | Type Ransomware Operating system(s) affected | |
TeslaCrypt was a ransomware trojan. It is now defunct, and its master key released by the developers. A free decryption tool is available on the web.
In its early forms, TeslaCrypt targeted game-play data for specific computer games. Newer variants of the malware also affect other file types.
In its original, game-player campaign, upon infection the malware searched for 185 file extensions related to 40 different games, which include the Call of Duty series, World of Warcraft, Minecraft and World of Tanks, and encrypted such files. The files targeted involve the save data, player profiles, custom maps and game mods stored on the victim's hard drives. Newer variants of TeslaCrypt were not focused on computer games alone but also encrypted Word, PDF, JPEG and other files. In all cases, the victim would then be prompted to pay a ransom of $500 worth of bitcoins in order to obtain the key to decrypt the files.
Although resembling CryptoLocker in form and function, Teslacrypt shares no code with CryptoLocker and was developed independently. The malware infected computers via the Angler Adobe Flash exploit.
Even though the ransomware claimed TeslaCrypt used asymmetric encryption, researchers from Cisco’s Talos Group found that symmetric encryption was used and developed a decryption tool for it. This "deficiency" was changed in version 2.0, rendering it impossible to decrypt files affected by TeslaCrypt-2.0.
By November 2015, security researchers from Kaspersky had been quietly circulating that there was a new weakness in version 2.0, but carefully keeping that knowledge away from the malware developer so that they could not fix the flaw. As of January 2016, a new version 3.0 was discovered that had fixed the flaw.
A full behavior report, which shows BehaviorGraphs and ExecutionGraphs was published by JoeSecurity.
In May 2016, the developers of TeslaCrypt shut down the ransomware and released the master decryption key, thus bringing an end to the ransomware. After a few days, ESET released a public tool to decrypt affected computers at no charge. This tool can be downloaded here: http://download.eset.com/special/ESETTeslaCryptDecryptor.exe