<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Ransomware Encryption Analysis — API Reference

## PyCryptodome

### Installation

```bash
pip install pycryptodome
```

### AES Decryption

```python
from Crypto.Cipher import AES

# AES-CBC
cipher = AES.new(key, AES.MODE_CBC, iv)
plaintext = cipher.decrypt(ciphertext)

# AES-CTR
cipher = AES.new(key, AES.MODE_CTR, nonce=nonce)
plaintext = cipher.decrypt(ciphertext)

# AES-GCM (authenticated)
cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
plaintext = cipher.decrypt_and_verify(ciphertext, tag)
```

### ChaCha20

```python
from Crypto.Cipher import ChaCha20
cipher = ChaCha20.new(key=key, nonce=nonce)
plaintext = cipher.decrypt(ciphertext)
```

### RSA

```python
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP

key = RSA.import_key(private_key_data)
cipher = PKCS1_OAEP.new(key)
decrypted_key = cipher.decrypt(encrypted_key_blob)
```

## findaes

```bash
# Find AES key schedules in memory dumps
findaes memory.dmp

# Output: offset and key bytes for each found key schedule
```

## Volatility3 — Key Recovery

```bash
# Dump ransomware process memory
vol3 -f dump.dmp windows.memmap --pid <pid> --dump

# Search for crypto constants
vol3 -f dump.dmp windows.vadyarascan --yara-file crypto_rules.yar

# List open file handles (may reveal key files)
vol3 -f dump.dmp windows.handles --pid <pid> --type File
```

## ID Ransomware

Website: https://id-ransomware.malwarehunterteam.com/

Upload:
- Ransom note (text file)
- Sample encrypted file
- Ransom email address

Returns: Family identification + available decryptors

## No More Ransom Decryptors

Website: https://www.nomoreransom.org/en/decryption-tools.html

Provides free decryptors for families with recovered keys or broken encryption.

## Common Ransomware File Formats

### Footer-appended metadata (common pattern)

```
[encrypted_content][IV (16 bytes)][encrypted_AES_key (256 bytes)][original_size (8 bytes)]
```

### Header-prepended metadata

```
[magic (4 bytes)][version (4 bytes)][IV (16 bytes)][encrypted_content]
```

### Intermittent encryption

```
[encrypted_block (N bytes)][unencrypted_block (M bytes)][repeat...]
```

Common ratios: 1MB encrypted / 2MB skipped (LockBit), 512KB / 512KB
