You are welcome to discuss various security topics with our professional team and other users like you!
Read our Registration Agreement and create your FREE account here!

*

Execute

  • *****
  • 388
  • +55/-0
  • Your friendly neighbourhood IT guy
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #15 on: February 08, 2016, 10:36:35 am »
@Tazzoli and @bertoz,

files are received. Know that, for every computer the public and private keys are different, so for every computer we will need to find different keys for a possible recovery of the files.
Having the public key helps, but the encryption is very strong. For now, we haven't successfully decrypted anything, but will keep trying!

Kind Regards,
Execute

*

bertoz

  • *
  • 4
  • +0/-0
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #16 on: February 09, 2016, 01:35:47 pm »
Thanks execute!
if it helps I can send the email with the zip file containing the virus
how can I provide the public keys?

if you need any more information or files I'm available

best regards
bertoz

*

Execute

  • *****
  • 388
  • +55/-0
  • Your friendly neighbourhood IT guy
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #17 on: February 10, 2016, 09:41:42 am »
@bertoz,

The keys can probably be found in files named like:
  • recover_file_dfphhxqrr.txt
  • recover_file_hmoymagcn.txt
  • recover_file_lqnwjbbyd.txt
  • recover_file.txt

As for the zip file - we already have a sample of the virus, thank you.

Kind Regards,
Execute

*

bertoz

  • *
  • 4
  • +0/-0
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #18 on: February 10, 2016, 10:45:50 pm »
hi executo
i found 4 file recover_..........txt
i sent them by mail

i hope can be useful

*

Execute

  • *****
  • 388
  • +55/-0
  • Your friendly neighbourhood IT guy
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #19 on: February 11, 2016, 10:53:08 am »
@bertoz,
that is indeed helpful,
but it seems that for now we are unable to extract the other key needed for decryption.
We will keep trying, though - don't lose hope, as previous versions were decrypted.

Kind Regards,
Execute
« Last Edit: February 11, 2016, 02:58:43 pm by Execute »

*

bertoz

  • *
  • 4
  • +0/-0
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #20 on: March 04, 2016, 07:52:36 pm »
hi execute
do you have any news?  ;)
i don't lose hope, I continue to seek information on the internet

if I can help in some way let me know
best regards
bertoz

*

Execute

  • *****
  • 388
  • +55/-0
  • Your friendly neighbourhood IT guy
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #21 on: March 07, 2016, 11:10:33 am »
@bertoz,

Hi, we thought we cracked it, but sadly we couldn't decrypt files with the .micro extension.
I am glad that you haven't given up and want to help, but for now there is no known solution.

We will keep on tampering with the files.

Kind Regards,
Execute

*

mcerdem

  • *
  • 11
  • +0/-1
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #22 on: May 26, 2016, 07:38:43 pm »
is there anyone who need help for one of below files ?

 .vvv, .ecc, .ezz, .exx, .xyz, .zzz, .aaa, .abc, .ccc, .xxx, .ttt, .micro, mp3 and "no extension change on last version

*

Execute

  • *****
  • 388
  • +55/-0
  • Your friendly neighbourhood IT guy
      • View Profile
Re: Restore Files Encrypted with .xxx .ttt and .micro File Extensions
« Reply #23 on: May 27, 2016, 11:27:56 am »
is there anyone who need help for one of below files ?

 .vvv, .ecc, .ezz, .exx, .xyz, .zzz, .aaa, .abc, .ccc, .xxx, .ttt, .micro, mp3 and "no extension change on last version

If anybody needs help with decrypting TeslaCrypt locked files - this is the MASTER decryption key: 440241DD80FCC5664E86198DB716E08CE627D8D40C7EA360EA855C7EA360AE885C727A49EE

This means that with this key you can decrypt files encrypted by any variant/version of TeslaCrypt (with the above mentioned extensions, or no extensions).

In "The End of TeslaCrypt" article you can find more information about how to decrypt your files and about what tools you can use to do it!

If you still need help or have any questions, feel free to ask them here in the forums.