Foro de elhacker.net

Hola a todos, mirando sobre este nuevo ransomware, encontré una tool para recuperarlos.
Pueden ver el tema aquí, información y funcionamiento:

http://blogs.cisco.com/security/talos/teslacrypt?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+feedburner%2FTalos+%28Talos+Blog%29 (http://blogs.cisco.com/security/talos/teslacrypt?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+feedburner%2FTalos+%28Talos+Blog%29)

The Talos TeslaCrypt Decryption Tool:

(http://blogs.cisco.com/wp-content/uploads/TeslaCrypt-Tool-550x242.png)

Lista de comandos a usar:

    /help – Show the help message
    /key – Manually specify the master key for the decryption (32 bytes/64 digits)
    /keyfile – Specify the path of the “key.dat” file used to recover the master key.
    /file – Decrypt an encrypted file
    /dir – Decrypt all the “.ecc” files in the target directory and its subdirs
    /scanEntirePc – Decrypt “.ecc” files on the entire computer
    /KeepOriginal – Keep the original file(s) in the encryption process
    /deleteTeslaCrypt – Automatically kill and delete the TeslaCrypt dropper (if found active in the target system)

Descarga:

Windows binary:
http://labs.snort.org/files/TeslaDecrypt_exe.zip (http://labs.snort.org/files/TeslaDecrypt_exe.zip)
ZIP SHA256: 57ce1c16e920a9e19ea1c14f9c323857c9a40751619d3959684c7e17956d66c6

Python script:
https://labs.snort.org/files/TeslaDecrypt_python.zip (https://labs.snort.org/files/TeslaDecrypt_python.zip)
ZIP SHA256: ea58c2dd975ed42b5a30729ca7a8bc50b6edf5d8f251884cb3b3d3ceef32bd4e

Source code to Windows binary:
https://labs.snort.org/files/TeslaDecrypt_cpp.zip (https://labs.snort.org/files/TeslaDecrypt_cpp.zip)
ZIP SHA256: 45908f0b3f8eb73bf820ded0a886842ac5c3e4c83068097806daad662046b1e0

Espero les sirva de ayuda.

Saludos.