Ransomeware Malware

What is ransomware?

• Ransomware is a part of a Malware
• It looks like a simple executable file, but whenever it executed on a machine . it will automatically encrypt all of your file with advanced encryption algorithm. 
• Ransomware is on trending on cyber-war.

What is ransomware attack?

• First of all an attacker try to infect your machine with ransomware.
• Now the ransomware malware will encrypt your machine and you can not access your data,
• For decryption you required a software called "Crypter" as well as a key for decryption, which can only be with attacker only. 
• Now attacker ask for some money in form of Bit-coins to hide its identity, this money is called ransom.After you pay to attacker.he/she will give you software and a key..
• This is called a ransomware attack.

Why it is difficult to decrypt the files without payment?

• First of all we don't know from which encryption system did the attacker use it can be....
• RSA
• DSA
• AES etc
• Now if we get the idea regarding the encryption now we have to search for a key.
• Attacker give the crypter after ransom payment only so we can not crack it or bypass the key without a software.
• Now again if we somehow manage the crpyper , we have to look for a key, we can apply a brute force to find a key , but here the problem is that the combination of possible key in RSA-256  is 2^256 ,now if it is RSA-512 than the key possibility is 2^512. so it will take couples of year to decrypt it.

Example : RDX-ransomware

• Here i have make a simple python program for files encryption
• you can find the source code on my github too.:
• Github Link
• NOTE: Try it at your own risk and this is for educational purpose only

BEFORE ATTACK

• You can see the files available in a folder,which look normal before ransomware attack

    AFTER ATTACK

• Now for encryption you have to just run a "rdx-ransomware.py" into your target folder,it will generate a decryption key into key.key folder and remove the program it self .
• You can see that the all files are encrypted and renamed with ".RDX" as a file extension.

AFTER DECRYPTION

• To decrypt your files you have to run "rdx-crypter.py" into attacked folder.
• Now here you have to gave a key from "key.key" as an input to out crypter.
• Now after the decryption all of your files are decrypted and you can easily access it.