TeslaCrypt is a file-encrypting ransomware program intended for all Windows versions including Windows Vista, Windows XP, Windows 7 and Windows 8. The ransomware program first released towards the end February 2015. ELECTRIC JACK After it has infected your computer, TeslaCrypt will search for data files and then encrypt them using AES encryption so that you will no longer be allowed to open them. After all your data files are infected, an app will be displayed. It will provide information about how to retrieve the files. The instructions will include the link to a decryption service TOR site. This site will provide details about the current ransom amount, how many files have been encrypted, as well as how to pay the ransom so your files can be released. The ransom amount usually starts at $500. It is payable through Bitcoins. Each victim will have their own Bitcoin address. After TeslaCrypt has been installed on your computer it will create a randomly-labeled executable within the folder %AppData%. The executable starts and scans your computer's drive letters to find files to encrypt. When it discovers a supported data file, it encrypts it and attaches an extension that is new to the file's name. This name is derived from the version that is affecting your computer. The program now uses different file extensions to encrypt encrypted files with the release of new versions of TeslaCrypt. Currently, TeslaCrypt uses the following extensions: .ccc, .abc, .aaa, .zzz, .xyz, .exx, .ezz and .ecc. There is a chance that you could use the TeslaDecoder tool to decrypt your encrypted files at no cost. It depends on which version of TeslaCrypt is affected. You should note that TeslaCrypt will scan all of the drive letters on your computer to find files to encrypt. It can scan network shares, DropBox mappings and removable drives. However, it only targets the data files on network shares when you have the share assigned as a drive letter on your computer. The ransomware will not encode files on network shares if you don't have the network share that is mapped as a drive letter. After it has finished scanning your computer, it will erase all Shadow Volume Copies. The ransomware does this to prevent you from restoring affected files. The version of the ransomware is indicated by the application's title, which appears after encryption. How your computer gets infected by TeslaCrypt TeslaCrypt is a computer virus that can be infected if the user goes to a hacker site that has an exploit kit and old software. Hackers hack websites to distribute the malware. An exploit kit is a software program that they install. This tool exploits weaknesses in your computer's programs. Acrobat Reader and Java are just a couple of the programs that are vulnerable. weaknesses. After the exploit kit has successfully exploited the vulnerabilities on your computer, it automatically installs and starts TeslaCrypt. Jack It is crucial to ensure that Windows and all other programs are up to date. It protects your system from vulnerabilities that could cause infection by TeslaCrypt. This ransomware was the first to target data files that are used by PC video games in a proactive manner. It targets game files for games like MineCraft, Steam, World of Tanks, League of Legends Half-life 2. Diablo, Fallout 3 Skyrim, Dragon Age Dragon Age, Call of Duty and RPG Maker are just a few of the games it targets. However, it has not been determined if games targeting gamers increase the revenue of the malware creators. Versions of TeslaCrypt and related file extensions TeslaCrypt is regularly updated to incorporate new file extensions and encryption techniques. The first version encrypts files which have the extension.ecc. In this scenario, the encrypted files are not coupled with data files. TeslaDecoder can also be used to retrieve the original decryption key. If the decryption keys were zeroed out and the key was found to be partial in key.dat, it is possible. The decryption key can also be found in the Tesla request that was sent to the server. Another version is available with encrypted file extensions.ecc or.ezz. If the decryption key was not zeroed out, one cannot recover the original key. The encrypted files are not paired with the data file. Decryption key can be git from the Tesla request that is sent to the server. For the version that has an extension file name .ezz and .exx the original decryption key is not recovered without the authors' private key when the decryption keys was zeroed out. The encrypted files that have the extension .exx are linked to data files. You can also request a decryption key from the Tesla server. Versions with encrypted files with extensions.ccc.,.abc..aaa..zzz, and.xyz do not utilize data files. The decryption key cannot be saved on your computer. It is only decrypted in the event the victim captured the key while it was being sent to the server. You can get the encryption key by calling Tesla. It is not possible to do this for versions that are older than TeslaCrypt v2.1.0. TeslaCrypt 4.0 is now available The authors have released TeslaCrypt4.0 sometime in March 2016. A brief analysis shows that the latest version fixes a glitch that previously corrupted files bigger than 4GB. It also has new ransom notes and doesn't make use of an extension for encrypted files. The absence of an extension makes it difficult for users to find out the details of TeslaCryot and what happened to their files. The ransom notes can be used to establish routes for victims. There isn't a lot of established ways to decrypt files with no extension without a purchased decryption keys or Tesla's private key. If the user is able to capture the key while it was being transmitted to an online server the files could be decrypted.