New TeslaCrypt variant now uses the .MP3 Extension

[Petrovic]

A new variant of the TeslaCrypt ransomware was released that contains some minor changes.  The version number is still 3.0. but the ransom notes have been renamed and the file extension for encrypted files is now .MP3. Unfortunately, there is still no way to decrypt this latest version of TeslaCrypt.

 

The new ransom note filenames are now in the format _H_e_l_p_RECOVER_INSTRUCTIONS+[3-characters].png,_H_e_l_p_RECOVER_INSTRUCTIONS+[3-characters].txt, and _H_e_l_p_RECOVER_INSTRUCTIONS+[3-characters].HTML. Other than that, the ransom notes are worded the same way.

 

The other change is that TeslaCrypt is currently encrypting data files with the .MP3 extension. That means that if the original filename is test.jpg, once it is encrypted it will be changed to test.jpg.mp3. You can see examples of the encrypted files in the image below.

 

 

Unfortunately at this time there is still no way to decrypt the newew variants of TeslaCrypt.

Article source