Cisco 's Talos security research team released a free decryption tool a few days ago for victims of the TeslaCrypt ransomware , which can be used to decrypt files locked by the malware.
According to researchers, TeslaCrypt appears to be based on the widely spread ransomware CryptoLocker and uses symmetric AES encryption, which allowed Cisco to create a tool for decrypting victims' files using the ransomware's decryption key.
Interestingly, TeslaCrypt warns of using strong asymmetric AES-2048 encryption to lock victims' files, however, this is not the case.
TeslaCrypt are of great value to users, forcing them to pay the ransom demanded to decrypt their files. A Game Save, for example, which may be the result of countless hours of gameplay, is extremely valuable to a gamer and very difficult to replace.
The Cisco researchers managed to locate and analyze two samples of Teslacrypt, which they used as the basis for developing the decryption tool.
«Using reverse engineering, we analyzed how TeslaCrypt works and managed to develop the tool based on it», said Talos security researcher Earl Carter. «In the past, we have also used reverse engineering on other ransomware, such as Cryptowall, but in this case the ransomware used asymmetric encryption and creating a tool was not feasible».
Recently, Kaspersky Lab also released a free decryption tool for victims of the CoinVault. Kaspersky worked with Dutch police, who managed to gain access to CoinVault stored on a command & control server of the ransomware. The researchers used this information to create a decryption tool, which can be found at the link: https://noransom.kaspersky.com
The tool is not 100 percent effective, but as the research progresses, police hope to discover new keys and improve the success rate of the decryption software.
