New TeslaCrypt Ransomware sets its scope on video gamers

it seems that teslacrypt has deleted the key.

It worked, storage.bin was decrypted and checked, but unfortunately your decryption key was already destroyed by TeslaCrypt. TeslaCrypt destroys decryption key when all of your files were encrypted. When this happens I can't recover your decryption key from data file without TeslaCrypt's writters private key.
When decryption key can't be recovered I recommend to backup up all your encrypted files, data file (key.dat or storage.bin) and recovery_key.txt or recovery_file.txt and wait for another solution.

doesnot work for me and:

Loading data file from >> C:\Users\farhad\AppData\Roaming\key.dat
Data file version 3 recognized.
ERROR - Decryption key is not present in data file.
Decryption key was destroyed by TeslaCrypt.
Unfortunately this tool can't recover decryption key. :-(

Edited by mehrdad63, 19 May 2015 - 05:32 AM.

The TeslaDecoder provided by Bloodydolly is infected with a virus(or to be specific with malware). So be careful using stuffs of ppl. who have only 32 Posts in summary :-).

Edited by buto, 19 May 2015 - 10:14 AM.

 

The TeslaDecoder provided by Bloodydolly is infected with a virus(or to be specific with malware). So be careful using stuffs of ppl. who have only 32 Posts in summary :-).

 

 'C:\Users\xxx\Desktop\TeslaDecoder\TeslaDecoder.exe' : 'HEUR/APC (Cloud)' [HEUR/APC]

 

Go trolling somewhere else or give me a proof.

Edited by BloodDolly, 19 May 2015 - 10:15 AM.

The TeslaDecoder provided by Bloodydolly is infected with a virus(or to be specific with malware). So be careful using stuffs of ppl. who have only 32 Posts in summary :-).
 
 'C:\Users\xxx\Desktop\TeslaDecoder\TeslaDecoder.exe' : 'HEUR/APC (Cloud)' [HEUR/APC]

 

The TeslaDecoder provided by Bloodydolly is infected with a virus(or to be specific with malware). So be careful using stuffs of ppl. who have only 32 Posts in summary :-).
 
 'C:\Users\xxx\Desktop\TeslaDecoder\TeslaDecoder.exe' : 'HEUR/APC (Cloud)' [HEUR/APC]

buto, can you tell us which Antivirus/Antimalware gave you this detection on BloodDolly's executable? It's most likely a false positive.

 

http://www.avira.com/de/support-threats-description/tid/7815/tlang/en

The TeslaDecoder provided by Bloodydolly is infected with a virus(or to be specific with malware). So be careful using stuffs of ppl. who have only 32 Posts in summary :-).
 
 'C:\Users\xxx\Desktop\TeslaDecoder\TeslaDecoder.exe' : 'HEUR/APC (Cloud)' [HEUR/APC]

Hats off to BloodDolly.  After some careful research, I was able to d/l and use the TeslaDecoder and located and pointed to the decryption key, and was able to decrypt several thousand files that were previously encrypted and unusable.

I am so impressed, and I suppose a little lucky!!

Thanks again.

If you need details, please let me know.

 

The TeslaDecoder provided by Bloodydolly is infected with a virus(or to be specific with malware). So be careful using stuffs of ppl. who have only 32 Posts in summary :-).
 
 'C:\Users\xxx\Desktop\TeslaDecoder\TeslaDecoder.exe' : 'HEUR/APC (Cloud)' [HEUR/APC]

I tested this program before allowing it to remain posted. Do you think I would have created a news article and allowed it to be used if it was a computer infection?

The program is safe to use.

 

So why does his software have malware characteristics and the TeslaDecrypter not? They should do the same job. And he's able to change to content of the zip like he wants. Maybe you've checked the first version, without any malware.

Because the first Version has no malware characteristics... I checked it.

Edited by buto, 19 May 2015 - 10:30 AM.

So why does his software have malware characteristics and the TeslaDecrypter not? They should do the same job. And he's able to change to content of the zip like he wants. Maybe you've checked the first version, without any malware.

Because the first Version has no malware characteristics... I checked it.

 

 

The TeslaDecoder provided by Bloodydolly is infected with a virus(or to be specific with malware). So be careful using stuffs of ppl. who have only 32 Posts in summary :-).
 
 'C:\Users\xxx\Desktop\TeslaDecoder\TeslaDecoder.exe' : 'HEUR/APC (Cloud)' [HEUR/APC]

I tested this program before allowing it to remain posted. Do you think I would have created a news article and allowed it to be used if it was a computer infection?

The program is safe to use.

 

So why does his software have malware characteristics and the TeslaDecrypter not? They should do the same job. And he's able to change to content of the zip like he wants. Maybe you've checked the first version, without any malware.

Because the first Version has no malware characteristics... I checked it.

 

Reverse it and you will see that nothing malicious is there. I am not going to comment a FP of an antivirus that detected itself in the past.

https://www.virustotal.com/en/file/7079a5f9465d3e91f6c203663804764ee32e8df41f6d39f0f66f40a775123226/analysis/1432219331/

Detection ratio: 1 / 57

Might be a false positive?!

because it does decrypt the couple files i've tested so far!!!

what do you think?

https://www.virustotal.com/en/file/7079a5f9465d3e91f6c203663804764ee32e8df41f6d39f0f66f40a775123226/analysis/1432219331/

 

Detection ratio: 1 / 57

Tencent Trojan.Win32.Qudamah.Gen.0 20150521

 

Might be a false positive?!

because it does decrypt the couple files i've tested so far!!!

 

what do you think?

FP

I have EXX files on my server, though the server doesn't appear to be infected

and the PC that was infected had no server drives mapped.

I copied the key that Tesladecoder was showing when I cleaned the infected PC

Is there a way to use that to clean the files on the server?

Does Tesladecoder delete the registry key after cleaning the system?