Green "Success" on two drives.
Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.
Cisco's Talos Group releases decryptor for TeslaCrypt
Started by
Grinler
, Apr 27 2015 01:54 PM
30 replies to this topic
#16
jimsjims
-
- Members
- 5 posts
- OFFLINE
- Local time:07:21 AM
Back to top
#17
jimsjims
-
- Members
- 5 posts
- OFFLINE
- Local time:07:21 AM
Posted 30 April 2015 - 08:57 PM
many files still have a .ezz added. I guess these are not decrypted.
#18
Grinler
- Topic Starter
-
- Admin
- 45,113 posts
- OFFLINE
Lawrence Abrams
- Gender:Male
- Location:USA
- Local time:09:21 AM
Posted 30 April 2015 - 09:16 PM
EZZ is the new alpha crypt version. Not sure if Andrei's tool runs against that one. Were you infected twice? Make sure you update all the programs on your computer as these are coming in exploit kits.
#19
jimsjims
-
- Members
- 5 posts
- OFFLINE
- Local time:07:21 AM
Posted 30 April 2015 - 09:19 PM
not sure, could have been twice. the hard drive was working hard for some time before I realized what was going on. What do you mean, update all the programs? Many things won't run at all. I can't get malwarebytes or roguekiller to run, for example.
#20
jimsjims
-
- Members
- 5 posts
- OFFLINE
- Local time:07:21 AM
Posted 30 April 2015 - 09:25 PM
While searching key.dat I found a
Crystal_Keychains-medium[1].dat
file created on april 27 which is the day I believe I was infected. do you perhaps recognize that keyfile for another encryption program?
#21
Callaway1027
-
- Members
- 2 posts
- OFFLINE
- Local time:09:21 AM
Posted 01 May 2015 - 12:25 PM
Same problem on my moms computer Grin. I have the recovery_kiy file buy no key.dat. Any way to get this file back without reinjecting telsa?
#22
joeyjr
-
- Members
- 6 posts
- OFFLINE
- Local time:03:21 PM
#23
hadi9520
-
- Members
- 4 posts
- OFFLINE
- Local time:09:21 AM
Posted 06 May 2015 - 10:57 PM
Added an update to the first post:
Update 4/28/15: If TeslaDecrypt cannot find a key.dat file, search your hard drive and if the file can be found move it to the same folder as TeslaDecrypt and try again.
Hi everyone;
I found the file, now how I can move it TeslaDecrypt folder
#24
Ansgar
-
- Members
- 7 posts
- OFFLINE
- Local time:02:21 PM
Posted 07 May 2015 - 03:36 AM
Hello to You all,
in my versions of TeslaCrypt the master key was stripped from the key.dat file and so the current Cisco tool was not be able to help me decrypting my data.
I was able though to rescue some files before they were encrypted, by copying them on a external hard-drive. Thus i have two Versions of them now: One not and one encrypted. Would it be helpful to the specialists here in the blog or for those at Cisco, if i would share These files with them ?
Sorry if this question might sound silly to You, but i am not an IT-specialist at all...
Thank You in advance ........and Thank You for all the work You alreaddy have done, to help the victims of this ransom-Software !
#25
Grinler
- Topic Starter
-
- Admin
- 45,113 posts
- OFFLINE
Lawrence Abrams
- Gender:Male
- Location:USA
- Local time:09:21 AM
Posted 07 May 2015 - 10:42 AM
Thank you...with the encryption this malware has, having a copy of the original and encrypted files wont help.
#26
Grinler
- Topic Starter
-
- Admin
- 45,113 posts
- OFFLINE
Lawrence Abrams
- Gender:Male
- Location:USA
- Local time:09:21 AM
Posted 11 May 2015 - 01:45 PM
For those interested, Cisco released the source code for TeslaDecrypt on May 8th:
https://github.com/vrtadmin/TeslaDecrypt/
Unfortunately, their releasing of the source makes me think they are hoping someone else picks up the torch on this ransomware. I hope I am proved wrong.
https://github.com/vrtadmin/TeslaDecrypt/
Unfortunately, their releasing of the source makes me think they are hoping someone else picks up the torch on this ransomware. I hope I am proved wrong.
#27
BloodDolly
-
- Security Colleague
- 526 posts
- OFFLINE
- Gender:Male
- Location:Slovakia
- Local time:02:21 PM
Posted 13 May 2015 - 03:13 PM
You can try my TeslaDecoder. It works only when decryption key is still present in data file (key.dat, storage.bin) or windows registry entries. Supported extensions are .ecc, .ezz, .exx
http://www.dropbox.com/s/abcziurxly2380e/TeslaDecoder.zip?dl=0
I hope it will help to someone. :-)
#28
andy2000
-
- Members
- 2 posts
- OFFLINE
- Local time:01:21 PM
Posted 17 May 2015 - 04:32 AM
Hi this is a very interesting topic. My wife's computer was infected with this virus on Wednesday, all jpgs now have the extension jpg.exx and there is the ransom note. I can not find a key.dat file. We have reinstalled windows 7 but still have the old version plus encrypted files in the windows.old folder. Should I watch this topic and hope someone might crack this one day? Thanks.
#29
IOOP
-
- Members
- 3 posts
- OFFLINE
- Local time:03:21 PM
Posted 19 May 2015 - 01:41 AM
Hy,
I am one of the "lucky" people infected by criptolocker. Me files has been modifed in exx type of file extension, can I try some tools in order to uncript the corupted files?
#30
xXToffeeXx
-
- Malware Response Instructor
- 6,088 posts
- OFFLINE
Bleepin' Polar Bear
- Gender:Female
- Location:The Arctic Circle
- Local time:02:21 PM
Posted 19 May 2015 - 03:53 AM
Hy,
I am one of the "lucky" people infected by criptolocker. Me files has been modifed in exx type of file extension, can I try some tools in order to uncript the corupted files?
See here: TeslaDecoder released to decrypt .EXX, .EZZ, .ECC files encrypted by TeslaCrypt
xXToffeeXx~
ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here
~Twitter~ | ~Malware Analyst at Emsisoft~
1 user(s) are reading this topic
0 members, 1 guests, 0 anonymous users
