<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-ransomware-encryption-algorithms
description: >-
  Analyze encryption algorithms used by ransomware families for incident response
  and recovery assessment. Covers identifying cipher suites, key derivation
  methods, IV generation flaws, and evaluating decryption feasibility using
  static and dynamic analysis techniques.
domain: cybersecurity
subdomain: cryptography
tags:
  - ransomware
  - encryption-analysis
  - incident-response
  - malware-analysis
  - reverse-engineering
  - decryption
  - key-recovery
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Analyzing Ransomware Encryption Algorithms

## Overview

Ransomware encryption analysis determines whether decryption is feasible
without paying ransom. Many ransomware families have implementation flaws —
weak RNG, predictable IVs, local key storage, or flawed key exchange — that
enable recovery. This skill covers systematic analysis of ransomware crypto
implementations during incident response.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling and analysis scripts |
| radare2 / Ghidra | Binary analysis (`apt install radare2`) |
| YARA | `apt install yara` / `pip install yara-python` |
| OpenSSL 3.x | Cipher identification |
| file / binwalk | File type identification |

## Key Concepts

### Ransomware Crypto Patterns

| Pattern | Example Families | Recovery Chance |
|---|---|---|
| AES-CBC + RSA-2048 (correct) | LockBit, BlackCat | Low — requires key |
| AES-ECB (flawed mode) | Early WannaCry variants | Medium — pattern analysis |
| XOR with static key | Simple ransomware | High — key recovery trivial |
| ChaCha20 + RSA | Conti, Royal | Low — correct implementation |
| Custom cipher | Amateur ransomware | High — often breakable |
| AES with predictable IV | Implementation flaws | Medium — IV recovery |

### Identifying Encryption Used

```bash
# Check encrypted file headers for magic bytes
file encrypted_file.locked
xxd encrypted_file.locked | head -20

# Look for crypto constants in binary (AES S-box, RSA)
strings ransomware.exe | grep -iE '(AES|RSA|ChaCha|Salsa|encrypt|decrypt|key)'

# YARA rule for crypto identification
yara -r crypto_signatures.yar ransomware.exe

# Entropy analysis (encrypted files have high entropy ~7.99)
ent encrypted_file.locked

# Compare entropy of original vs encrypted
python3 -c "
import math, collections, sys
data = open(sys.argv[1], 'rb').read()
freq = collections.Counter(data)
entropy = -sum((c/len(data)) * math.log2(c/len(data)) for c in freq.values())
print(f'Entropy: {entropy:.4f} bits/byte')
" encrypted_file.locked
```

### Key Recovery Indicators

```bash
# Search for keys in memory dumps
strings memdump.raw | grep -E '^[0-9a-f]{64}$'

# Look for RSA private key markers
strings memdump.raw | grep -A1 "PRIVATE KEY"

# Search process memory for AES key schedule
# AES-256 expanded key is 240 bytes
volatility3 -f memdump.raw windows.memmap --pid <pid> --dump

# Check for key files dropped by ransomware
find / -name "*.key" -o -name "*ransom*" -o -name "*decrypt*" 2>/dev/null
```

### Static Analysis

```bash
# Radare2 analysis for crypto functions
r2 -A ransomware.exe -c "afl~crypt" -q
r2 -A ransomware.exe -c "afl~AES" -q
r2 -A ransomware.exe -c "afl~RSA" -q

# Search for crypto API imports (Windows)
r2 ransomware.exe -c "ii~Crypt" -q

# Identify WinCrypt API usage
strings ransomware.exe | grep -E '(CryptEncrypt|CryptGenKey|CryptImportKey|BCrypt)'
```

## Workflow

1. **Triage** — Identify ransomware family (ransom note, extension, IOCs)
2. **Sample** — Collect encrypted files and ransomware binary safely
3. **Identify** — Determine encryption algorithm via static/dynamic analysis
4. **Assess** — Evaluate implementation for known weaknesses
5. **Recover** — Attempt key recovery from memory, flaws, or known decryptors
6. **Document** — Report findings for IR timeline and law enforcement

## Verification

| Check | Method |
|---|---|
| Family identified | Ransom note hash matches known families on ID Ransomware |
| Algorithm confirmed | Crypto API calls or constants found in binary |
| Entropy validated | Encrypted files show entropy > 7.9 bits/byte |
| Decryptor checked | No More Ransom project checked for available tool |
| Memory preserved | RAM dump captured before system shutdown |

## References

- [No More Ransom Project](https://www.nomoreransom.org/)
- [ID Ransomware](https://id-ransomware.malwarehunterteam.com/)
- [MITRE ATT&CK T1486 — Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/)
- [CISA Ransomware Guide](https://www.cisa.gov/stopransomware)
