Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


CryptoLocker Virus Sample Availalble

  • This topic is locked This topic is locked
1 reply to this topic

#1 A P Bustraan

A P Bustraan

  • Members
  • 24 posts
  • Local time:06:29 PM

Posted 15 April 2015 - 12:11 AM

I had a client who was hit with the latest cryptolocker virus. .ECC File Extension. 29,000 files on a workstation and 56,000 files on a network share. Lost the workstation, but the network was recoverable (6 hour rollback),

Was able to capture exe and related files. Packed in a protected zip and already opened a request with McAfee, who and how else to submit my sample for someone to try and build a better mouse trap, or decryption?




BC AdBot (Login to Remove)


#2 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 52,090 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:29 PM

Posted 15 April 2015 - 04:56 AM

You are dealing with TeslaCrypt Ransomware. Unlike other ransomware that typically target images, documents, videos, and applications databases, TeslaCrypt also targets over 40 different video game related files. Any files that are encrypted will have the .ecc extension added to the end of the filename. At this time there is no fix tool and no way to decrypt the files.

You can submit a sample of an encrypted file here: http://www.bleepingcomputer.com/submit-malware.php?channel=3
with a link to this topic.

You can also submit samples of suspicious executables or any malware files that you suspect were involved in causing the infection. Doing that will be helpful with analyzing and investigating.

There is an ongoing discussion in this topic: New TeslaCrypt Ransomware sets its scope on video gamers

Rather than have everyone start individual topics, it would be best (and more manageable for staff) if you posted any questions, comments or requests for assistance in that topic discussion.

The BC Staff
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users