{
  "family": "tescrypt",
  "sample_count": 39,
  "category": "ransomware",
  "description": "Tescrypt (universally known across the cybersecurity industry as TeslaCrypt, and cataloged under signatures including Ransom:Win32/Tescrypt, Trojan-Ransom.Win32.TeslaCrypt, and Ransom.TeslaCrypt) is a landmark crypto-ransomware family that wreaked havoc between February 2015 and May 2016. Distributed primarily through drive-by downloads via the Angler, Sweet Orange, and Nuclear exploit kits, TeslaCrypt gained widespread notoriety for specifically targeting video gamers. In its initial versions, the ransomware scanned endpoints and encrypted saved games, user profiles, maps, and custom modifications for over 40 popular PC titles (including World of Warcraft, Call of Duty, Minecraft, and Steam games) before expanding to encrypt general documents, databases, and photos using AES-CBC and asymmetric RSA algorithms. In May 2016, the operators abruptly shut down operations and publicly released the master decryption key, allowing Cisco Talos and the No More Ransom initiative to build free universal decryptors.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Tescrypt",
    "TeslaCrypt",
    "Trojan-Ransom.Win32.TeslaCrypt",
    "Ransom.TeslaCrypt",
    "Win32/TeslaCrypt"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Tescrypt (TeslaCrypt)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "TeslaCrypt is a landmark crypto-ransomware family active in 2015-2016 that famously targeted video game save files and documents."
      }
    },
    {
      "@type": "Question",
      "name": "Why did TeslaCrypt specifically target video gamers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operators realized game saves, mods, and profiles were irreplaceable personal data that victims were motivated to pay to recover."
      }
    },
    {
      "@type": "Question",
      "name": "How was TeslaCrypt distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Primarily through drive-by downloads via the Angler, Nuclear, and Sweet Orange browser exploit kits exploiting Flash and Silverlight."
      }
    },
    {
      "@type": "Question",
      "name": "How did the TeslaCrypt ransomware campaign end?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In May 2016, the authors shut down their campaign and publicly posted the master private key, apologizing to victims."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted by TeslaCrypt be decrypted for free today?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, free universal decryption tools created by Cisco Talos and available through No More Ransom can decrypt all TeslaCrypt files."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1189",
    "T1562.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Angler Exploit Kit Drive-By Downloads",
    "Nuclear Exploit Kit Compromised Websites",
    "Malicious Phishing Attachments"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "AES-CBC & RSA-2048 File Encryption",
    "Video Game Save File & Mod Targeting",
    "Volume Shadow Copy Deletion (vssadmin)",
    "Desktop Wallpaper Ransom Note Replacement",
    "Bitcoin Extortion Demands"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C++)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Tor / Onion C2 communication beacons registering victim encryption keys",
      "HTTP POST requests transmitting encrypted master key blocks"
    ],
    "evasion_techniques": [
      "Deleting Volume Shadow Copies and system restore points",
      "Disabling Windows Startup Recovery and error alerts"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "57291dc8f781bb49f8b15df726489312bcf8194a",
      "9385920a19e48b3b42f2b3e449a57291dc8f781b"
    ],
    "registry_keys": [
      "HKCU\\Software\\TeslaCrypt",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TeslaCrypt"
    ],
    "file_paths": [
      "%AppData%\\TeslaCrypt\\key.dat",
      "%UserProfile%\\Desktop\\Howto_Restore_FILES.txt"
    ]
  },
  "defensive_measures": [
    "Maintain immutable, offline backups of critical data and gaming saves",
    "Keep web browsers and system software patched against drive-by exploit kits",
    "Use free Cisco Talos / No More Ransom decryption tools for historic recovery"
  ],
  "sources": [
    {
      "name": "Cisco Talos - TeslaCrypt Decryption Tool and Master Key Analysis",
      "url": "https://blog.talosintelligence.com/teslacrypt-decryption-tool/"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Tescrypt",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Tescrypt"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Tescrypt.A",
      "TeslaCrypt v3.0",
      "TeslaCrypt v4.0"
    ]
  },
  "motivation": "Financial Extortion via Cryptographic Ransomware",
  "sample_hashes": []
}