{"id":12169,"date":"2016-05-23T09:12:13","date_gmt":"2016-05-23T13:12:13","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=12169"},"modified":"2020-02-26T11:09:26","modified_gmt":"2020-02-26T16:09:26","slug":"raknidecryptor-vs-teslacrypt","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/raknidecryptor-vs-teslacrypt\/12169\/","title":{"rendered":"Kaspersky free decryptor for TeslaCrypt victims"},"content":{"rendered":"<p>As we\u2019ve <a href=\"https:\/\/www.kaspersky.com\/blog\/teslacrypt-master-key\/\" target=\"_blank\" rel=\"noopener nofollow\">mentioned earlier<\/a>, the creators of TeslaCrypt, the constantly evolving trojan-cryptor, have suddenly decided to stop its distribution and release a master key. A master key is a key that can be used to decrypt any file encrypted by latest versions of TeslaCrypt.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/05\/06022204\/teslacrypt-decryptor-FB.jpg\"><img decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/05\/06022204\/teslacrypt-decryptor-FB.jpg\" alt=\"Kaspersky Lab's utility decrypts files encrypted by TeslaCrypt ransomware\" width=\"1280\" height=\"1280\" class=\"aligncenter size-full wp-image-12170\"><\/a><\/p>\n<p>Malware analysts at Kaspersky Lab used this master key to update our <a href=\"https:\/\/support.kaspersky.com\/viruses\/disinfection\/10556\" target=\"_blank\" rel=\"noopener\">RakhniDecryptor tool<\/a>, which is designed for decrypting files damaged by several types of ransomware, to version 1.15.10.0. This update has added support for TeslaCrypt v3 and v4.<\/p>\n<p>Prior to the update, RakhniDecryptor helped users impacted with TeslaCrypt v1 and v2. The publication of the master key gave us the chance to add support for TeslaCrypt v3 and v4 (both are detected by <a href=\"https:\/\/www.kaspersky.com\/advert\/multi-device-security?redef=1&amp;THRU&amp;reseller=gl_KDpost_pro_ona_smm__onl_b2c_kasperskydaily_lnk____kismd___&amp;_ga=1.225171866.1273636079.1462449050\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky Internet Security<\/a> and other Kaspersky anti-virus products as <b>Trojan-Ransom.Win32.Bitman<\/b>).<\/p>\n<p>So, if you have fallen victim to some ransomware and your encrypted files have one of the following extensions:<\/p>\n<p><i>.xxx, .ttt, .micro, .mp3 or their original extension<\/i><\/p>\n<p>We suggest that you try our utility which may help you get your files back.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Master decryption key released for <a href=\"https:\/\/twitter.com\/hashtag\/TeslaCrypt?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#TeslaCrypt<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ransomware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#ransomware<\/a> via <a href=\"https:\/\/twitter.com\/threatpost?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@threatpost<\/a> <a href=\"https:\/\/t.co\/YTqlZeYZ6z\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/YTqlZeYZ6z<\/a> <a href=\"https:\/\/t.co\/I9wsK2cq3J\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/I9wsK2cq3J<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/733337632135073794?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">May 19, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>To decrypt your files, follow this simple steps:<\/p>\n<p>1. Download <a href=\"http:\/\/media.kaspersky.com\/utilities\/VirusUtilities\/EN\/rakhnidecryptor.exe\" target=\"_blank\" rel=\"noopener nofollow\">RakhniDecryptor<\/a> from our site and install it on your PC;<\/p>\n<p>2. Run RakhniDecryptor.exe;<\/p>\n<p>3. Click the <b>Change parameters<\/b> button;<\/p>\n<p>4. Select objects that you want to scan. Most likely it would be only your hard drive, but if you had removable drives installed or open network shares connected \u2014 you\u2019d better tick these as well.<\/p>\n<p>5. You can select <b>Delete crypted files after decryption<\/b> to clean up your hard drive from encrypted files, but we recommend that you don\u2019t. It\u2019s better to get 100% sure that the files were really decrypted before deleting the originals. After that click <b>Ok<\/b><\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/05\/06022201\/rakhnidecryptor-01.png\"><img decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/05\/06022201\/rakhnidecryptor-01.png\" alt=\"rakhnidecryptor\" width=\"490\" height=\"450\" class=\"aligncenter size-full wp-image-12175\"><\/a><\/p>\n<p>6. Hit the <b>Start Scan<\/b> button.<\/p>\n<p>7. In the <b>Specify the path to one of encrypted files<\/b>, select one of the files you need to restore and click <b>Open<\/b>.<\/p>\n<p>8. Wait until the RakhniDecryptor recovers your files. <em>Please note that this process may take a significant amount of time.<\/em><\/p>\n<p>We hope that our utility can help you get your files back. In order not to fall victim to some other ransomware we recommend you to use proactive protection, such as <a href=\"https:\/\/www.kaspersky.com\/advert\/multi-device-security?redef=1&amp;THRU&amp;reseller=gl_KDpost_pro_ona_smm__onl_b2c_kasperskydaily_lnk____kismd___&amp;_ga=1.225171866.1273636079.1462449050\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky Internet Security<\/a> that can stop ransomware before it has even started encrypting your files.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kaspersky Lab RakhniDecryptor utility updated to help decrypt files encrypted by previously invincible versions of TeslaCrypt.<\/p>\n","protected":false},"author":696,"featured_media":12171,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2683,9],"tags":[1680,759,352,1629,420,1106,131,723,1627],"class_list":{"0":"post-12169","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"category-tips","10":"tag-cryptors","11":"tag-free","12":"tag-kaspersky-lab","13":"tag-rakhnidecryptor","14":"tag-ransomware","15":"tag-teslacrypt","16":"tag-tips","17":"tag-trojans","18":"tag-utilities"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/raknidecryptor-vs-teslacrypt\/12169\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/raknidecryptor-vs-teslacrypt\/7172\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/raknidecryptor-vs-teslacrypt\/7227\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/raknidecryptor-vs-teslacrypt\/7160\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/raknidecryptor-vs-teslacrypt\/8362\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/raknidecryptor-vs-teslacrypt\/8227\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/raknidecryptor-vs-teslacrypt\/12021\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/raknidecryptor-vs-teslacrypt\/5704\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/raknidecryptor-vs-teslacrypt\/6289\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/raknidecryptor-vs-teslacrypt\/7743\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/raknidecryptor-vs-teslacrypt\/11479\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/raknidecryptor-vs-teslacrypt\/12021\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/raknidecryptor-vs-teslacrypt\/12169\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/raknidecryptor-vs-teslacrypt\/12169\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/tips\/","name":"tips"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/696"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=12169"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12169\/revisions"}],"predecessor-version":[{"id":33695,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12169\/revisions\/33695"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/12171"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=12169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=12169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=12169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}