TeslaDecoder released to decrypt .EXX, .EZZ, .ECC files encrypted by TeslaCrypt

A free decryption tool was released by BloodDolly called TeslaDecoder. This utility has the ability to decrypt files encrypted by TeslaCrypt.

TeslaDecoder can now decrypt all variants of TeslaCrypt 3.x and 4.x. This includes encrypted file extensions: .micro, .xxx, .ttt, .mp3, and encrypted files that were not renamed.
 

TeslaDecoder Decryption Tool

TeslaDecoder can be downloaded from this url:
 

http://download.bleepingcomputer.com/BloodDolly/TeslaDecoder.zip

A changelog for the tool can be found here:
 

http://download.bleepingcomputer.com/BloodDolly/changelog.txt

For older versions of TeslaCrypt, when run, TeslaDecoder will search for certain Windows registry keys, the storage.bin file, or key.dat file, and if detected, will attempt to extract your decryption key. Once a decryption key is extracted it will allow you to decrypt all the files in a particular folder or all files on a computer. Unfortunately, on some victim's computers the decryption key has been stripped from the data files. In this situation, TeslaDecoder will be unable to help you recover your files.

For newer versions of TeslaCrypt, which most people are currently affected by, you will need to read the instructions contained in the download to learn how to decrypt your files.

We have already updated our TeslaCrypt guide with information about TeslaDecoder. For the latest information about TeslaCrypt, you can always visit the guide below that is continuously updated as new information is released:
 

TeslaCrypt and Alpha Crypt Ransomware Information Guide and FAQ

Update 5/19/15 - Included link to download
Update 1/8/16 - Added information about the instructions included in the download.
Update 5/18/16 - TeslaDecoder can now decrypt all variants of TeslaCrypt 3.x and 4.x

Edited by Grinler, 18 May 2016 - 03:43 PM.
Forgot to post link to download

I was wondering when BloodDolly's Decrypter would get it's own thread. It'll be easier now for him to offer support for it Time to edit my canneds to include it. Can the victims of TeslaCrypt (.ecc variant) still rely on the CISCO's Talos Group decrypter if BloodDolly's one fails?

Edited by Aura., 18 May 2015 - 03:52 PM.

i tried to use this decoder but didn't work on key file storage.bin
warning message :

• - data file version 4 recognized
• - descryption key is not present in data file
• - decryption key was destroyed by teslacrypt
• - unfortunately this tool can't recover descryption key :-( 

 
nb: i move storage.bin to drive C:\file virus and i load manually use this decoder
 
so how?? any update or something i miss??

I have placed links about this tool in all related topics.

i tried to use this decoder but didn't work on key file storage.bin
warning message :

• - data file version 4 recognized
• - descryption key is not present in data file
• - decryption key was destroyed by teslacrypt
• - unfortunately this tool can't recover descryption key :-( 

 
nb: i move storage.bin to drive C:\file virus and i load manually use this decoder
 
so how?? any update or something i miss??

It worked, storage.bin was decrypted and checked, but unfortunately your decryption key was already destroyed by TeslaCrypt. TeslaCrypt destroys decryption key when all of your files were encrypted. When this happens I can't recover your decryption key from data file without TeslaCrypt's writters private key.
When decryption key can't be recovered I recommend to backup up all your encrypted files, data file (key.dat or storage.bin) and recovery_key.txt or recovery_file.txt and wait for another solution.

Can the victims of TeslaCrypt (.ecc variant) still rely on the CISCO's Talos Group decrypter if BloodDolly's one fails?

They can try it. :-)
But I don't think it will help, because Talos decrypter only takes 32B number from offsets 0x77 and 1xDB without checking.

like i said on another topics I am one of the many people that had "the pleasure to meet". I had remove the executable which infected the files from my computer, I use in order to recover back the encrypted files the following tolls (shadow explorer, recuva) with no luck, the recuva tolls recover back only bacup files from windows partition useless. can I try  

TeslaDecoder released to decrypt .EXX or is to late?

 

Or any other tolls that can help me recover the encrypted files.

 

One mention, the extention file of the encripted docs is exx.

 

Thanks

That's good, thank you BloodDolly Also, should we redirect people using your Decrypter tool to this thread for support? Because I think you noticed that some users post in the 2-3 threads about TeslaCrypt/Alpha Crypt about your tool if they have question. They basically copy/paste their reply in all the threads. I don't know if it would be easier for you to get them all redirected here.

BloodDolly is subscribed to all the related topics and is handling support questions. Further, I already provided links to this topic.

I know that, but what if someone creates a new thread about the decrypter, like this one:

http://www.bleepingcomputer.com/forums/t/576652/how-repare-files-infected-to-tesla/

Should it be redirected in the TeslaCrypt thread, or this one since the user is having issues with the Decrypter?

Edit: Well I guess that you just answered my question in that thread

Edited by Aura., 19 May 2015 - 07:51 AM.

Then just report it so staff can reply and close the topic.

That's good, thank you BloodDolly Also, should we redirect people using your Decrypter tool to this thread for support? Because I think you noticed that some users post in the 2-3 threads about TeslaCrypt/Alpha Crypt about your tool if they have question. They basically copy/paste their reply in all the threads. I don't know if it would be easier for you to get them all redirected here.

Yes, you can redirect them here. It would be good to have it only in one thread. Thanks.

@IOOP:
Try my tool and you will see if you still have decryption key present in data file (key.dat or storage.bin).
But first read readme.txt file. :-)

BloodDolly,

 

If the decryption key has been removed from key.dat, have you had any luck using the Recovery_File.txt file?

 

Thanks

 

Ron

BloodDolly,

 

If the decryption key has been removed from key.dat, have you had any luck using the Recovery_File.txt file?

 

Thanks

 

Ron

Unfortunately it is not about luck to get decryption key back when it is destroyed. It is possible in reasonable time in version 1 and 2, but since version 3 they start using ECDH for key exchange. As I wrote in antoher threads (http://www.bleepingcomputer.com/forums/t/575875/new-teslacrypt-version-released-that-uses-the-exx-extension/?view=findpost&p=3708417)
(http://www.bleepingcomputer.com/forums/t/575875/new-teslacrypt-version-released-that-uses-the-exx-extension/?view=findpost&p=3708349) there is nothing to do right now when decryption key was destroyed. The key part is in Tesla/AlphaCrypt creators and without their private key it is matematically impossible to get it/brute force in reasonable time.

Edited by BloodDolly, 19 May 2015 - 04:55 PM.