[Grinler]

Both BleepingComputer's and Bromium's writeups state that it uses AES. Only the malware exec states that it uses RSA.

Have you tested being able to decrypt using the key.dat?

[Blaze]

This is teslacrypt. Notice the version number in the GUI title and game extensions.

Yep, I suspected it was TeslaCrypt, but was unsure when I got the CryptoWall message. Maybe this user had both installed at one point, but the shortcuts to the ransom note were (still) of CryptoWall.

[AaLl86]

Both BleepingComputer's and Bromium's writeups state that it uses AES. Only the malware exec states that it uses RSA.

Have you tested being able to decrypt using the key.dat?

Yes I have tested it, I am able to recover the key from that file...

Andre

[Grinler]

Both BleepingComputer's and Bromium's writeups state that it uses AES. Only the malware exec states that it uses RSA.

Have you tested being able to decrypt using the key.dat?

Yes I have tested it, I am able to recover the key from that file...

Andre

And you are able to decrypt files using it? If so, do you plan on releasing a decrypter to help those affected?

[Blaze]

And you are able to decrypt files using it? If so, do you plan on releasing a decrypter to help those affected?

Yes, you can recover a key from there, but not sure which one it is as you need 2 keys. A decryption key AND a verification key. So not sure if this would be possible.

Two more samples attached.

[Grinler]

And you are able to decrypt files using it? If so, do you plan on releasing a decrypter to help those affected?

Yes, you can recover a key from there, but not sure which one it is as you need 2 keys. A decryption key AND a verification key. So not sure if this would be possible.

Two more samples attached.

Yup, I know a key and bitcoin address resides in there, but can it actually be used to decrypt your data?

Or is this the victims private encryption key which was then encrypted by the devs master public key, which has become common lately.

[AaLl86]

Based on the test that I have made, a new dropper is on the wild. This new version produces the "key.dat" file that is 0x2f0 bytes wide...
I think that the new release brings something new. If someone gets the chance to obtain this new dropper please ping me...

Andrea

[AaLl86]

Tesla_22Apr2015_Dropper.rar

22 April 2015 Dropper
(348.76 KiB) Downloaded 100 times

Here is the new dropper. It produces "key.dat" file 0x2f0 bytes wide.
I have had still no time to deep analyse it but it brings some new light differences (like the storing of the master key in the windows registry - Software\Microsoft\Windows\CurrentVersion\SET key).

Attached the archive with the original dropper and the unpacked one...

Andrea

[AaLl86]

Here is my analysis: http://blogs.cisco.com/security/talos/teslacrypt

Hope that can be useful for you all!

Andrea

[gaprabbit]

i want to lean it