The malware will also create two files on the computer, one plain text and one HTML, which both contain instructions on how to pay the ransom and receive a decryption key. For example, the previous TeslaCrypt version (2.1) used a file extension of. The file extension used changes regularly. The latest version of TeslaCrypt, known as version 2.2, will encrypt the user’s files and append their file names with a. Should the recipient open this attachment, the file will download and install TeslaCrypt on the user's computer.

This attached file is detected by Symantec as JS.Downloader. Although disguised as a legitimate document, the attachment is, in fact, a JavaScript file containing heavily obfuscated malicious code intended to evade antivirus scanners. zip file extension or may have no file extension at all. Would you be nice enough to provide us with a wire transfer confirmation.Įach email contains an attachment with a file name usually including the word “invoice”, “doc”, or “info”, in addition to random characters.Examples of the subject lines used in these emails include:

Much of the current wave of TeslaCrypt attacks involves spam emails using a range of social engineering techniques to lure the recipient into opening them. TeslaCrypt () detections since August 1, 2015 Its creators have continually refined the malware and the tactics used to distribute it, making it one of the more dangerous threats currently in circulation.įigure 1. TeslaCrypt uses strong encryption to encrypt a wide range of files on the victim’s computer. Attack groups behind the ransomware known as TeslaCrypt (detected by Symantec as ) have ramped up activity in the past two weeks, sending out massive volumes of spam emails seeded with the malware.

Unencrip crypto locker