<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-ransomware-variants
description: >-
  Analyze ransomware samples to identify variant families, encryption methods,
  key management weaknesses, and decryptor availability. Covers static and
  dynamic analysis, YARA rule creation, ID Ransomware integration, No More
  Ransom decryptor lookup, and ransomware family fingerprinting for LockBit,
  BlackCat/ALPHV, Cl0p, Royal, Black Basta, Akira, and Play.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - ransomware-analysis
  - malware-analysis
  - yara
  - decryptors
  - lockbit
  - blackcat
  - encryption-analysis
  - reverse-engineering
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Analyzing Ransomware Variants

## Overview

Ransomware variant identification is critical for recovery — it determines
whether a free decryptor exists, what encryption scheme was used, and which
threat actor group is responsible. Rapid identification within the first hour
can mean the difference between paying ransom and free recovery.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| YARA | Signature matching | `pip install yara-python` |
| ssdeep | Fuzzy hashing | `apt install ssdeep` |
| pe-tree | PE structure analysis | `pip install pe-tree` |
| DIE | Detect It Easy | GitHub release |
| Capa | Capability detection | GitHub release |
| VirusTotal API | Multi-engine scan | API key required |

## Key Concepts

### Major Ransomware Families (2024-2026)

| Family | Extension | Ransom Note | Encryption | Decryptor |
|--------|-----------|-------------|------------|-----------|
| LockBit 3.0 | Random 9-char | `[ID].README.txt` | AES-256 + RSA-2048 | No |
| BlackCat/ALPHV | Random 6-7 char | `RECOVER-[rand]-FILES.txt` | AES-128 + RSA | No |
| Cl0p | `.Cl0p` | `ClopReadMe.txt` | AES-256 + RSA-1024 | Partial |
| Royal | `.royal` | `README.TXT` | AES-256 + RSA-4096 | No |
| Black Basta | `.basta` | `readme.txt` | ChaCha20 + RSA-4096 | No |
| Akira | `.akira` | `akira_readme.txt` | ChaCha20 + RSA-4096 | Partial |
| Play | `.play` | `ReadMe.txt` | AES-RSA hybrid | No |

### Encryption Analysis Workflow

```
Sample Collection
├── Ransom note → family fingerprint
├── Encrypted file + known plaintext → crypto analysis
├── Ransomware binary → static/dynamic analysis
└── Network artifacts → C2 infrastructure mapping

Analysis Pipeline:
1. Hash sample → check VirusTotal, MalwareBazaar
2. YARA scan → match known family signatures
3. Static analysis → strings, imports, PE structure
4. Dynamic analysis → sandbox execution (ANY.RUN, Joe Sandbox)
5. Crypto assessment → key derivation, IV reuse, implementation flaws
```

## Workflow

### Step 1 — Sample Collection and Hashing

```bash
# Collect artifacts safely
mkdir -p /evidence/ransomware/{binary,notes,encrypted,original}

# Hash everything immediately
sha256sum /evidence/ransomware/binary/* > /evidence/hashes.txt
md5sum /evidence/ransomware/binary/* >> /evidence/hashes.txt
ssdeep /evidence/ransomware/binary/* > /evidence/fuzzy-hashes.txt

# Extract strings from binary
strings -n 8 /evidence/ransomware/binary/sample.exe > /evidence/strings.txt
strings -el /evidence/ransomware/binary/sample.exe >> /evidence/strings.txt
```

### Step 2 — YARA Scanning

```yaml
# ransomware_families.yar
rule LockBit3 {
    meta:
        description = "Detects LockBit 3.0 ransomware"
        family = "LockBit"
        mitre = "T1486"
    strings:
        $note1 = "restore-my-files.txt" ascii nocase
        $note2 = "LockBit 3.0" ascii
        $ext = ".lockbit" ascii
        $mutex = "Global\\{" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

rule BlackCat_ALPHV {
    meta:
        description = "Detects BlackCat/ALPHV ransomware"
        family = "BlackCat"
    strings:
        $rust = "rust_panic" ascii
        $note = "RECOVER-" ascii
        $note2 = "-FILES.txt" ascii
        $cfg = "\"config_id\":" ascii
    condition:
        uint16(0) == 0x5A4D and ($rust and 1 of ($note*)) or $cfg
}

rule BlackBasta {
    meta:
        description = "Detects Black Basta ransomware"
        family = "BlackBasta"
    strings:
        $ext = ".basta" ascii
        $note = "instructions_read_me" ascii nocase
        $chacha = { 65 78 70 61 6E 64 20 33 32 2D 62 79 74 65 20 6B }
    condition:
        uint16(0) == 0x5A4D and 2 of them
}
```

```bash
# Scan sample against YARA rules
yara -s ransomware_families.yar /evidence/ransomware/binary/

# Scan with community rules
yara -r /opt/yara-rules/malware/ /evidence/ransomware/binary/
```

### Step 3 — VirusTotal Lookup

```bash
# Check hash against VirusTotal
HASH=$(sha256sum /evidence/ransomware/binary/sample.exe | cut -d' ' -f1)

curl -s "https://www.virustotal.com/api/v3/files/$HASH" \
  -H "x-apikey: $VT_API_KEY" | \
  jq '{
    detection_ratio: "\(.data.attributes.last_analysis_stats.malicious)/\(.data.attributes.last_analysis_stats.undetected + .data.attributes.last_analysis_stats.malicious)",
    threat_label: .data.attributes.popular_threat_classification.suggested_threat_label,
    family: .data.attributes.popular_threat_classification.popular_threat_name[0].value,
    first_seen: .data.attributes.first_submission_date
  }'
```

### Step 4 — Capability Analysis with Capa

```bash
# Analyze ransomware capabilities
capa /evidence/ransomware/binary/sample.exe --json | \
  jq '.rules | to_entries[] | select(.value.meta.att_ck) | {
    capability: .key,
    attack: .value.meta.att_ck
  }'

# Expected ransomware capabilities:
# - encrypt files using AES/RSA
# - delete volume shadow copies
# - enumerate files on disk
# - modify access control lists
# - create mutex
```

### Step 5 — Check Decryptor Availability

```bash
# Automated check against No More Ransom
# Manual: https://nomoreransom.org/en/decryption-tools.html

# Check Emsisoft decryptors
# https://www.emsisoft.com/en/ransomware-decryption/

# Check Kaspersky decryptors
# https://noransom.kaspersky.com/

# ID Ransomware — upload ransom note + encrypted sample
# https://id-ransomware.malwarehunterteam.com
```

## Detection

```yaml
title: Ransomware Variants Detection
id: 39b608d6-55d0-4e57-8f50-2a172e16257e
status: experimental
description: Detects suspicious activity related to analyzing ransomware variants techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] Sample hashed (SHA-256, MD5, ssdeep) and documented
- [ ] YARA rules matched against known families
- [ ] VirusTotal/MalwareBazaar queried for threat intel
- [ ] Encryption method identified (algorithm + key management)
- [ ] Decryptor availability checked (No More Ransom, Emsisoft)
- [ ] Capa analysis reveals ransomware capabilities
- [ ] Findings documented in incident report

## References

- No More Ransom Project: https://nomoreransom.org
- ID Ransomware: https://id-ransomware.malwarehunterteam.com
- MITRE ATT&CK T1486: Data Encrypted for Impact
- MalwareBazaar: https://bazaar.abuse.ch
- YARA Documentation: https://yara.readthedocs.io
