Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cisco's Talos Group releases decryptor for TeslaCrypt


  • Please log in to reply
30 replies to this topic

#1 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 42,999 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:26 AM

Posted 27 April 2015 - 01:54 PM

Today Cisco's Talos Group posted an analysis of the TeslaCrypt ransomware along with a tool that may allow you to decrypt your files for free. Their findings indicate that the keys necessary to decrypt your files are in fact stored in the key.dat file created by TeslaCrypt. These keys, though, are shifted in a way that they are unable to be used without first restoring them to their original format. Unfortunately, depending on the version of TeslaCrypt that was installed, the master key may be stripped from the key.dat file and thus making free decryption currently not possible. Andrea Allievi, one of the researchers in this article is hoping that it may be possible to recover this master key in the future.
 

teslacrypt-tool-success.png


To try and retrieve your master key and decrypt your files, you will need to download Cisco's TeslaDecrypt tool and run it. TeslaDecrypt will search your hard drive for the key.dat file and try to recover the master key. If it is able to do so, it will prompt if you wish to decrypt the whole computer or a specific folder. Unfortunately, some versions of TeslaCrypt strip the master key from the key.dat file and this tool will not be able to help you.
 

teslacrypt-tool-fail.png


The researchers in the Cisco Talos Group are hoping to create an algorithm to retrieve this master key in the future.

Update 4/28/15: If TeslaDecrypt cannot find a key.dat file, search your hard drive and if the file can be found move it to the same folder as TeslaDecrypt and try again.

Unfortunately, as is often the case, the disclosure of flaws in ransomware programs will ultimately lead to the malware developer creating a new version that fixes it. For those who are infected, though, now is your chance to try and get your files back.


BC AdBot (Login to Remove)

 


#2 Sintharius

Sintharius

    Bleepin' Sniper


  • Malware Study Hall Senior
  • 5,598 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Netherlands
  • Local time:12:26 PM

Posted 27 April 2015 - 01:58 PM

Well, at least they released a fix (unlike the incident with CryptoDefense...)

From the fact that some version of TeslaCrypt strips the master key off the file, I'd say that the author is already aware of the flaw and attempted to patch it already.

Thanks for the info Grinler!
Member of the Bleeping Computer A.I.I. early response team!

#3 Valinorum

Valinorum

    Shadow Hide The Hunter


  • Malware Response Instructor
  • 1,018 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:04:26 PM

Posted 27 April 2015 - 02:09 PM

I currently have a user infected with this ransomware. I will ask him to run this.

Regards,
Valinorum

Geek U Graduate

I close my topic(s) with no replies for more than 4 days. PM me or Moderators to reactivate. All helps are provided via forum ergo do not PM me for help.

 


#4 A P Bustraan

A P Bustraan

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Local time:04:26 AM

Posted 27 April 2015 - 02:36 PM

I was able to copy the key.dat file from an infected system, but when I try and run the program, I get the message "I was not able to import the TeslaCrypt Master key!". Is that an incompatible key.dat file or corrupt? Is there some way to submit it to use it towards finding a more complete decryption?



#5 force41

force41

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:26 AM

Posted 27 April 2015 - 09:12 PM

Kudos to Andrea for some excellent work here!

 

Our infection was one in which the key had already been stripped from the key.dat file.  Perhaps one day, the algorithm may be learned.  In the meantime, Congratulations to those involved in producing the Tesla Decrypter.



#6 Jazzer.

Jazzer.

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:26 PM

Posted 27 April 2015 - 10:47 PM

Sadly our infection also had the key pre-stripped.

Great effort here though.

Hopefully the algorithm targeting the recovery key is possible in the near future!



#7 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 42,999 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:26 AM

Posted 28 April 2015 - 09:59 AM

Added an update to the first post:

Update 4/28/15: If TeslaDecrypt cannot find a key.dat file, search your hard drive and if the file can be found move it to the same folder as TeslaDecrypt and try again.

#8 rls92

rls92

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:26 AM

Posted 28 April 2015 - 10:14 AM

Sorry, new at this, can you describe how to search for the key.dat file on the hard drive?  Thanks!



#9 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 42,999 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:26 AM

Posted 28 April 2015 - 10:26 AM

Sorry, new at this, can you describe how to search for the key.dat file on the hard drive?  Thanks!


What version of windows are you using?

#10 rls92

rls92

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:26 AM

Posted 28 April 2015 - 10:34 AM

I believe Windows 8, it's on wife's computer which is unfortunately at home but it has apps and tiles. 



#11 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 42,999 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:26 AM

Posted 29 April 2015 - 01:30 PM

I believe Windows 8, it's on wife's computer which is unfortunately at home but it has apps and tiles.


Go to the Windows 8 start scree (that screen with all of the tiles) and just type C: and then press enter. THe start screen should go away and you will see the Windows desktop and C: drive open like below.

search-c.jpg


In the search field, indicated by the arrow in the image above, type key.dat and press enter. Windows will start search for the file. This will take a while so be patient. When its done you will see the where key.dat is located. An example of what it looks like on my computer is:

file-found.jpg



#12 rls92

rls92

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:26 AM

Posted 29 April 2015 - 01:36 PM

Thank you, I will give it a try!



#13 ilmagnifico22

ilmagnifico22

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:26 AM

Posted 30 April 2015 - 10:49 AM

Thank you, solved!



#14 rls92

rls92

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:06:26 AM

Posted 30 April 2015 - 08:46 PM

Found the key.dat file but alas no master key.  I will hope for a further solution, thanks again for your assistance.



#15 jimsjims

jimsjims

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:26 AM

Posted 30 April 2015 - 08:52 PM

HI All,

What computer-kicking malware/virus!

OK, I surfed and loaded the teslacrypt....the keyday file was found. the decryptor is running on my workstation as I type.

I'll follow up with results.

 

This is the toughest malware/virus I've had to deal with. My thanks to the 1000 lb brains at Talos!






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users