analyzing-ransomware-encryption-behavior

Name: analyzing-ransomware-encryption-behavior
Author: meltedinhex

18stars5forks

How to install analyzing-ransomware-encryption-behavior?

meltedinhex/analyst-ai-pack/analyzing-ransomware-encryption-behavior

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-ransomware-encryption-behavior

Installs into the current project.

Summary

Analyzes how a ransomware sample encrypts files: identifying the crypto scheme

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Ransomware Encryption Behavior
2
3	## When to Use
4
5	- You need to understand how a ransomware sample encrypts data and whether recovery without
6	the key is feasible.
7	- You are documenting file targeting, markers, and the ransom workflow for an IR report.
8	- You want to identify the crypto primitives to assess decryptability and detection points.
9
10	Do not use this to attempt key recovery on production data without backups; analyze in the
11	lab on disposable test files only.
12
13	## Prerequisites
14
15	- Isolated lab with disposable test files of varied types/sizes.
16	- Static/RE tools (see the Ghidra and crypto-identification skills) and the dynamic-analysis
17	setup.
18	- A clean snapshot to revert.
19
20	## Safety & Handling
21
22	- Detonate only against throwaway files in the isolated victim VM; never real data.
23	- Treat the sample and any dropped components as live; revert after each run.
24
25	## Workflow
26
27	### Step 1: Identify the crypto scheme statically
28
29	Locate crypto constants and APIs to classify the scheme:
30
31	```text
32	Symmetric only (AES/ChaCha/RC4) -> key may be derivable/recoverable if mishandled
33	Asymmetric (RSA/ECC) wrapping -> per-file symmetric key wrapped with attacker pubkey
34	Hybrid (typical) -> AES per file, RSA-wrapped key in the encrypted file/footer
35	```
36
37	Look for AES S-boxes, ChaCha constants ("expand 32-byte k"), and `CryptImportKey`/`BCrypt*`.
38
39	### Step 2: Trace key generation and handling
40
41	Determine where the symmetric key comes from (CSPRNG vs weak source), whether it is stored,
42	and how it is protected. Weak/reused keys or keys left in memory are recovery opportunities.
43
44	### Step 3: Map file targeting
45
46	Identify which directories/extensions are targeted or skipped (allowlist of system paths),
47	size thresholds, and partial-vs-full encryption (many encrypt only the first N bytes/blocks
48	for speed).
49
50	### Step 4: Capture markers and metadata
51
52	Most families append an extension, write a per-file footer/magic marker, and store the
53	wrapped key or IV there. The script fingerprints before/after test files to extract markers.
54
55	```bash
56	python scripts/analyst.py compare plain/ encrypted/
57	```
58
59	### Step 5: Document recovery-relevant facts
60
61	Note shadow-copy/backup deletion (`vssadmin delete shadows`), the ransom note, and any
62	cryptographic mistakes that affect decryptability.
63
64	## Validation
65
66	- The identified scheme matches observed file changes (e.g. hybrid → high-entropy body + a
67	fixed-size footer).
68	- File markers/extensions are consistent across encrypted test files.
69	- Shadow-copy deletion and note-drop are confirmed dynamically.
70
71	## Pitfalls
72
73	- Assuming decryptability from the algorithm name; correct AES/RSA usage is not recoverable.
74	Recovery hinges on implementation flaws or leaked keys.
75	- Missing partial-encryption schemes, leading to wrong impact assessment.
76	- Running against real files instead of disposable test data.
77
78	## References
79
80	- See [`references/api-reference.md`](references/api-reference.md) for the file-marker
81	comparison tool.
82	- No More Ransom and NIST crypto standards (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-ransomware-encryption-behavior

18stars5forks

View on GitHub

How to install analyzing-ransomware-encryption-behavior?

meltedinhex/analyst-ai-pack/analyzing-ransomware-encryption-behavior

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-ransomware-encryption-behavior

Installs into the current project.

Summary

Analyzes how a ransomware sample encrypts files: identifying the crypto scheme

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Ransomware Encryption Behavior
2
3	## When to Use
4
5	- You need to understand how a ransomware sample encrypts data and whether recovery without
6	the key is feasible.
7	- You are documenting file targeting, markers, and the ransom workflow for an IR report.
8	- You want to identify the crypto primitives to assess decryptability and detection points.
9
10	Do not use this to attempt key recovery on production data without backups; analyze in the
11	lab on disposable test files only.
12
13	## Prerequisites
14
15	- Isolated lab with disposable test files of varied types/sizes.
16	- Static/RE tools (see the Ghidra and crypto-identification skills) and the dynamic-analysis
17	setup.
18	- A clean snapshot to revert.
19
20	## Safety & Handling
21
22	- Detonate only against throwaway files in the isolated victim VM; never real data.
23	- Treat the sample and any dropped components as live; revert after each run.
24
25	## Workflow
26
27	### Step 1: Identify the crypto scheme statically
28
29	Locate crypto constants and APIs to classify the scheme:
30
31	```text
32	Symmetric only (AES/ChaCha/RC4) -> key may be derivable/recoverable if mishandled
33	Asymmetric (RSA/ECC) wrapping -> per-file symmetric key wrapped with attacker pubkey
34	Hybrid (typical) -> AES per file, RSA-wrapped key in the encrypted file/footer
35	```
36
37	Look for AES S-boxes, ChaCha constants ("expand 32-byte k"), and `CryptImportKey`/`BCrypt*`.
38
39	### Step 2: Trace key generation and handling
40
41	Determine where the symmetric key comes from (CSPRNG vs weak source), whether it is stored,
42	and how it is protected. Weak/reused keys or keys left in memory are recovery opportunities.
43
44	### Step 3: Map file targeting
45
46	Identify which directories/extensions are targeted or skipped (allowlist of system paths),
47	size thresholds, and partial-vs-full encryption (many encrypt only the first N bytes/blocks
48	for speed).
49
50	### Step 4: Capture markers and metadata
51
52	Most families append an extension, write a per-file footer/magic marker, and store the
53	wrapped key or IV there. The script fingerprints before/after test files to extract markers.
54
55	```bash
56	python scripts/analyst.py compare plain/ encrypted/
57	```
58
59	### Step 5: Document recovery-relevant facts
60
61	Note shadow-copy/backup deletion (`vssadmin delete shadows`), the ransom note, and any
62	cryptographic mistakes that affect decryptability.
63
64	## Validation
65
66	- The identified scheme matches observed file changes (e.g. hybrid → high-entropy body + a
67	fixed-size footer).
68	- File markers/extensions are consistent across encrypted test files.
69	- Shadow-copy deletion and note-drop are confirmed dynamically.
70
71	## Pitfalls
72
73	- Assuming decryptability from the algorithm name; correct AES/RSA usage is not recoverable.
74	Recovery hinges on implementation flaws or leaked keys.
75	- Missing partial-encryption schemes, leading to wrong impact assessment.
76	- Running against real files instead of disposable test data.
77
78	## References
79
80	- See [`references/api-reference.md`](references/api-reference.md) for the file-marker
81	comparison tool.
82	- No More Ransom and NIST crypto standards (linked in frontmatter).

People who liked this also viewed

6 picks

Type