| TeslaCrypt | |
|---|---|
| Technical name |
|
| Type | Ransomware |
| Subtype | Cryptovirus |
| Classification | Trojan horse |
| Technical details | |
| Platform | Windows |
TeslaCrypt was aransomwaretrojan. It is now defunct, and its master key was released by the developers.
In its early forms, TeslaCrypt targeted game-play data for specificcomputer games.[3][4][5][6] Newer variants of the malware also affect other file types.
In its original, game-player campaign, upon infection the malware searched for 185 file extensions related to 40 different games, which include theCall of Duty series,World of Warcraft,Minecraft andWorld of Tanks, and encrypted such files. The files targeted involve the save data, player profiles, custom maps andgame mods stored on the victim's hard drives. Newer variants of TeslaCrypt were not focused on computer games alone but also encrypted Word, PDF, JPEG and other files. In all cases, the victim would then be prompted to pay a ransom of $500 worth ofbitcoins in order to obtain the key to decrypt the files.[4][7]
Although resemblingCryptoLocker in form and function, Teslacrypt shares no code with CryptoLocker and was developed independently. The malware infected computers via the AnglerAdobe Flash exploit.[4][8]
Even though the ransomware claimed TeslaCrypt used asymmetric encryption, researchers from Cisco's Talos Group found that symmetric encryption was used and developed a decryption tool for it.[9] This "deficiency" was changed in version 2.0, rendering it impossible to decrypt files affected by TeslaCrypt-2.0.[10]
By November 2015, security researchers from Kaspersky had been quietly circulating that there was a new weakness in version 2.0, but carefully keeping that knowledge away from the malware developer so that they could not fix the flaw.[11] As of January 2016, a new version 3.0 was discovered that had fixed the flaw.[12]
A full behavior report, which shows BehaviorGraphs and ExecutionGraphs was published by JoeSecurity.[13]
In May 2016, the developers of TeslaCrypt shut down the ransomware and released the master decryption key, thus bringing an end to the ransomware.[14] After a few days,ESET released a public tool to decrypt affected computers at no charge.[15]
{{cite web}}: CS1 maint: others (link)