{
  "family": "tescrypt",
  "sample_count": 39,
  "category": "ransomware",
  "description": "Ransom:Win32/Tescrypt (universally known as TeslaCrypt) is an infamous, highly destructive file-encrypting ransomware family that emerged in 2015. It initially gained massive notoriety by uniquely targeting PC gamers, specifically encrypting video game save files, Steam configurations, and custom maps, before evolving to target all standard business documents and databases.<br><br><b>Understanding Tescrypt (TeslaCrypt)</b><br>For the victim, a Tescrypt infection is an absolute catastrophe. Their wallpaper is replaced with a ransom note, and every personal file (often appended with extensions like `.ecc`, `.ezz`, `.exx`, or `.vvv`) is locked behind strong AES cryptography. The attackers demanded payment in Bitcoin for the decryption key. For security analysts, Tescrypt represents the rapid evolution of the Ransomware-as-a-Service (RaaS) model. Notably, in a rare turn of events, the developers behind TeslaCrypt eventually shut down their operation in 2016 and publicly released the master decryption key, allowing victims to recover their files for free.<br><br><b>Execution and Evasion Strategies</b><br>Tescrypt was primarily distributed via massive spam campaigns and Exploit Kits (specifically the Angler EK) hosted on compromised websites. Upon execution, the malware establishes persistence via the Registry Run keys (`T1547.001`). It deletes the Windows Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy recovery (`T1490`). It then iterates through all local drives, mapped network shares, and connected USBs (`T1083`), utilizing AES-256 encryption to scramble the contents of targeted files (`T1486`). Tescrypt famously targeted over 180 specific file extensions, including those associated with Call of Duty, World of Warcraft, and Minecraft, alongside standard Office documents.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of data availability and severe business disruption. EDR platforms will flag the rapid, high-volume file modification operations (`WriteFile`) across user directories, coupled with the execution of `vssadmin.exe`. The presence of dropped ransom notes (e.g., `HELP_RESTORE_FILES.txt` or `HOWTO_RESTORE_FILES.bmp`) in every encrypted directory is the definitive IoC. Network logs may show Tor-based traffic reaching out to the payment portals.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1490",
    "T1486",
    "T1547.001",
    "T1083"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly sever the endpoint from the network, prioritizing the disconnection of mapped drives to prevent the ransomware from destroying corporate file shares.",
    "Do NOT reboot the machine immediately; a reboot may trigger secondary encryption routines or destroy the master key stored temporarily in RAM.",
    "Because the master decryption key for Tescrypt was released publicly in 2016, use free, trusted decryption tools (e.g., from ESET or Kaspersky) to recover the files.",
    "Perform a full forensic review to identify the initial infection vector (e.g., Angler EK via a compromised ad network) to patch the vulnerability."
  ],
  "what_to_avoid": [
    "Do NOT pay the ransom; the infrastructure is defunct, the operators are gone, and a free decryptor exists.",
    "Avoid relying solely on file deletion; ensure the registry persistence mechanisms are completely removed so it does not re-execute."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}