View Image

Talos has developed a decryption tool to aid users whose files have been encrypted by TeslaCrypt ransomware. The Talos TeslaCrypt Decryption Tool is an open source command line utility for decrypting TeslaCrypt encrypted files so users’ files can be returned to their original state.
TeslaCrypt malware encrypts the victim’s files such as photos, videos, documents, saved game files, and demands a ransom from the victim within a time limit. When the victim pays the ransom they can download a decryption key that will restore their files, otherwise the files are permanently lost.
Our decryption tool gives the victim the power to decrypt their files themselves, circumventing the ransomware.

Version 1.0 is able to decrypt all the files encrypted by all version of TeslaCrypt and AlphaCrypt:

TeslaCrypt 0.x - Encrypts files using an AES-256 CBC algorithm
AlphaCrypt 0.x - Encrypts files using AES-256 and encrypts the key with EC
TeslaCrypt 2.x - Same as previous versions, but uses EC to create a weak Recovery key. The application is able to use factorization to recover the victim's global private key.
TeslaCrypt 3 & 4 - The latest versions. Able to decrypt thanks to the C&C server EC private key which was recently released.