Hola a todos, mirando sobre este nuevo ransomware, encontré una tool para recuperarlos.
Pueden ver el tema aquí, información y funcionamiento:
http://blogs.cisco.com/security/talos/teslacrypt?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+feedburner%2FTalos+%28Talos+Blog%29
The Talos TeslaCrypt Decryption Tool:
Lista de comandos a usar:
/help – Show the help message
/key – Manually specify the master key for the decryption (32 bytes/64 digits)
/keyfile – Specify the path of the “key.dat” file used to recover the master key.
/file – Decrypt an encrypted file
/dir – Decrypt all the “.ecc” files in the target directory and its subdirs
/scanEntirePc – Decrypt “.ecc” files on the entire computer
/KeepOriginal – Keep the original file(s) in the encryption process
/deleteTeslaCrypt – Automatically kill and delete the TeslaCrypt dropper (if found active in the target system)
Descarga:
Windows binary:
http://labs.snort.org/files/TeslaDecrypt_exe.zip
ZIP SHA256: 57ce1c16e920a9e19ea1c14f9c323857c9a40751619d3959684c7e17956d66c6
Python script:
https://labs.snort.org/files/TeslaDecrypt_python.zip
ZIP SHA256: ea58c2dd975ed42b5a30729ca7a8bc50b6edf5d8f251884cb3b3d3ceef32bd4e
Source code to Windows binary:
https://labs.snort.org/files/TeslaDecrypt_cpp.zip
ZIP SHA256: 45908f0b3f8eb73bf820ded0a886842ac5c3e4c83068097806daad662046b1e0
Espero les sirva de ayuda.
Saludos.