- Home
Detectable Ransomware TeslaCrypt 2.x
Ransomware Research
TeslaCrypt 2.x Ransomware
TeslaCrypt 2.x is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on February 1, 2015, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- TeslaCrypt 2.x
- First Seen
- February 1, 2015
How TeslaCrypt 2.x Ransomware Works
Targeted Files
eed0eed86632ea74289e4ab2fccd0dcb27b5a9b754a7f6fc23287720cb7c38bd -> requires C&C
File Encryption Patterns
TeslaCrypt 2.x modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..vvv
..ecc
..ezz
..exx
..abc
..aaa
..zzz
..xyz
..ccc
Ransom Note and Payment Demands
After encrypting files, TeslaCrypt 2.x displays ransom notes demanding payment for file recovery:
HELP_RESTORE_FILES.txt
Ransom message:
notes/HELP_RESTORE_FILES.txt
Note locations:
Desktop
HELP_RESTORE_FILES.HTML
Ransom message:
notes/HELP_RESTORE_FILES.HTML
Note locations:
Desktop
HELP_TO_DECRYPT_YOUR_FILES.txt
Ransom message:
notes/HELP_TO_DECRYPT_YOUR_FILES.txt
Note locations:
Desktop
/\bhelp_restore_files_[a-z]{5}\.html\b/
Ransom message:
notes/help_restore_files_pwyfy.html
Note locations:
EveryFolder
/^restore_files_[a-z]{5}\.txt$/
Ransom message:
notes/restore_files_nluen.txt
Note locations:
EveryFolder
/^restore_files_[a-z]{5}\.html$/
Ransom message:
notes/restore_files_nluen.html
Note locations:
EveryFolder
/\bHELP_RESTORE_FILES_[a-z]{5}\.TXT\b/
Ransom message:
notes/HELP_RESTORE_FILES_pwqcy.TXT
Note locations:
EveryFolder
/\bhelp_restore_files_[a-z]{5}\.txt\b/
Ransom message:
notes/help_restore_files_pwyfy.txt
Note locations:
EveryFolder
/^how_recover\+[a-z]{3}\.html$/
Ransom message:
notes/how_recover+dtn.html
Note locations:
EveryFolder
/how_recover\+[a-z]{3}\.txt/
Ransom message:
notes/how_recover+dtn.txt
Note locations:
EveryFolder
Ransom message:
notes/HELP_TO_DECRYPT_YOUR_FILES.bmp
Note locations:
Desktop
Technical Indicators
Associated Executable Files
The following executable files are associated with TeslaCrypt 2.x ransomware:
qaaaggg.exe
calc
iinnnnb.exe
attqqqc.exe
bbccmmm.exe
wannacry.exe
qanenhe.exe
ggiwbmi.exe
teslaBeispiel.exe
046.exe
mbjinlf.exe
bmcncre.exe
1
d65b0160-sample
hsssspppx.exe
RS_Alphacrypt.exe
5.bin
Recovery and Decryption Tools
Good news! Decryption tools are available for TeslaCrypt 2.x ransomware:
0
Elastio Can Help You
Don't let TeslaCrypt 2.x ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This TeslaCrypt 2.x ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like TeslaCrypt 2.x.
Last updated: July 30, 2025