Engineering:TeslaCrypt
| Technical name |
|
|---|---|
| Classification | Trojan horse |
| Type | Ransomware |
| Subtype | Cryptovirus |
| Operating system(s) affected | Windows |
TeslaCrypt was a ransomware trojan. It is now defunct, and its master key was released by the developers.
In its early forms, TeslaCrypt targeted game-play data for specific computer games.[3][4][5][6] Newer variants of the malware also affect other file types.
In its original, game-player campaign, upon infection the malware searched for 185 file extensions related to 40 different games, which include the Call of Duty series, World of Warcraft, Minecraft and World of Tanks, and encrypted such files. The files targeted involve the save data, player profiles, custom maps and game mods stored on the victim's hard drives. Newer variants of TeslaCrypt were not focused on computer games alone but also encrypted Word, PDF, JPEG and other files. In all cases, the victim would then be prompted to pay a ransom of $500 worth of bitcoins in order to obtain the key to decrypt the files.[4][7]
Although resembling CryptoLocker in form and function, Teslacrypt shares no code with CryptoLocker and was developed independently. The malware infected computers via the Angler Adobe Flash exploit.[4][8]
Even though the ransomware claimed TeslaCrypt used asymmetric encryption, researchers from Cisco's Talos Group found that symmetric encryption was used and developed a decryption tool for it.[9] This "deficiency" was changed in version 2.0, rendering it impossible to decrypt files affected by TeslaCrypt-2.0.[10]
By November 2015, security researchers from Kaspersky had been quietly circulating that there was a new weakness in version 2.0, but carefully keeping that knowledge away from the malware developer so that they could not fix the flaw.[11] As of January 2016, a new version 3.0 was discovered that had fixed the flaw.[12]
A full behavior report, which shows BehaviorGraphs and ExecutionGraphs was published by JoeSecurity.[13]
Shut down
In May 2016, the developers of TeslaCrypt shut down the ransomware and released the master decryption key, thus bringing an end to the ransomware.[14] After a few days, ESET released a public tool to decrypt affected computers at no charge.[15]
References
- ↑ "Trojan.TeslaCrypt Description | F-Secure Labs". https://www.f-secure.com/v-descs/trojan_teslacrypt.shtml.
- ↑ "RANSOM_CRYPTESLA - Threat Encyclopedia - Trend Micro USA". https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/RANSOM_CRYPTESLA.
- ↑ Abrams, Lawrence (27 February 2015). "New TeslaCrypt Ransomware sets its scope on video gamers". http://www.bleepingcomputer.com/forums/t/568525/new-teslacrypt-ransomware-sets-its-scope-on-video-gamers/.
- ↑ 4.0 4.1 4.2 "Gamers targeted by ransomware virus". 13 March 2015. https://www.bbc.com/news/technology-31869589.
- ↑ Sean Gallagher (Mar 12, 2015). "CryptoLocker look-alike searches for and encrypts PC game files". https://arstechnica.com/security/2015/03/cryptolocker-look-alike-searches-for-and-encrypts-pc-game-files/.
- ↑ "New CryptoLocker ransomware targets gamers". March 13, 2015. http://www.zdnet.com/article/new-cryptolocker-ransomware-targets-gamers/.
- ↑ "TeslaCrypt Ransomware Encrypts Video Game Files". March 13, 2015. https://www.securityweek.com/teslacrypt-ransomware-encrypts-video-game-files.
- ↑ "Achievement Locked: New Crypto-Ransomware Pwns Video Gamers". March 12, 2015. http://labs.bromium.com/2015/03/12/achievement-locked-new-crypto-ransomware-pwns-video-gamers/.
- ↑ "Decryption tool available for TeslaCrypt ransomware that targets games". 2015. http://www.pcworld.com/article/2915812/decryption-tool-available-for-teslacrypt-ransomware-that-targets-games.html.
- ↑ Sinitsin, Fedor (14 July 2015). "TeslaCrypt 2.0 disguised as CryptoWall". AO Kaspersky Lab. https://securelist.com/blog/research/71371/teslacrypt-2-0-disguised-as-cryptowall/.
- ↑ Abrams, Lawrence. "TeslaCrypt Decrypted: Flaw in TeslaCrypt allows Victim's to Recover their Files". 2015 Bleeping Computer LLC. http://www.bleepingcomputer.com/news/security/teslacrypt-decrypted-flaw-in-teslacrypt-allows-victims-to-recover-their-files/.
- ↑ Abrams, Lawrence. "TeslaCrypt 3.0 Released with Modified Algorithm and .XXX, .TTT, and .MICRO File Extensions". 2015 Bleeping Computer LLC. http://www.bleepingcomputer.com/news/security/teslacrypt-3-0-released-with-new-encryption-algorithm-and-xxx-file-extensions/.
- ↑ "BehaviorReport Ransomware Teslacrypt". Joe Security. http://joesecurity.org/reports/report-43855c9d765fe7da2adcc4e6fb9d237c.html.
- ↑ "TeslaCrypt shuts down and Releases Master Decryption Key" (in en-us). http://www.bleepingcomputer.com/news/security/teslacrypt-shuts-down-and-releases-master-decryption-key/.
- ↑ "Criminals give away universal unlock key for TeslaCrypt-ransomware". https://www.guru3d.com/news-story/criminals-give-away-universal-unlock-key-for-teslacrypt-ransomware.html.
 |
