It’s official! A new TeslaCrypt version has been just detected by security researcher BloodDolly, who has dedicated his time investigating the ransomware and searching for decryption methods.
|Short Description||The ransom note of TeslaCrypt has been simplified, other changes are made, too.|
|Symptoms||Files are encrypted, Shadow Volume Copies are deleted.|
|Distribution Method||Not known yet, but possibly via malicious attachments and exploit kits.|
|Detection Tool||Download Malware Removal Tool, to See If Your System Has Been Affected by TeslaCrypt 4.2|
|User Experience||Join our forum to discuss TeslaCrypt 4.2.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
TeslaCrypt Version 4.2 Analysis and Description
TeslaCrypt Version 4.2 has some changes in its code, compared to previous releases. The most distinguished change is the renovation of the ransomware’s ransom note. It has been deprived from its detailed explanations, and only the basics have been left. In fact, only the needed details to connect to the payment servers are visible.
However, the alteration of the ransom note is not the only change. BloodDolly has outlined the following changes in TeslaCrypt’s code, as reported by Bleeping Computer:
- The compiler has been changed and the code is recompiled with optimization;
- The ransomware injects code to svchost.exe so that Shadow Volume Copies are deleted, as a result, the copies are deleted before and after encryption;
- Data file has been set as recovery file;
- Data file has been renamed to %MyDocuments%\-!recover!-!file!-.txt and is also encrypted;
- Data file size is altered to 272 B, 256 B in an unencrypted state;
- Run key is changed to [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] serv[5chars] C:\Windows\SYSTEM32\CMD.EXE /C START “” “[malwarepath].exe”;
- Network request is established only in case InternetGetConnectedState returns 1.
Here is a list of the files belonging to TeslaCrypt 4.2:
Here is a list of the Registry entries created by TeslaCrypt 4.2:
serv[5chars] C:\Windows\SYSTEM32\CMD.EXE /C START “”
TeslaCrypt 4.2 Removal. Decryption of Files
As already mentioned, TeslaCrypt 4.2 deletes Shadow Volume Copies. There is still no information as to what extension is appended to the files, and if a decryption method is available. However, decryption of files encrypted by later versions of TeslaCrypt is close to impossible. There are still alternative methods to be tried. Have a look at section 4 of the removal manual below.
Keep in mind that the most effective way to remove all traces of TeslaCrypt 4.2 from your system is via anti-malware software.
Note! Substantial notification about the TeslaCrypt 4.2 threat: Manual removal of TeslaCrypt 4.2 requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.