Inside the Guts of Ransomware

Ashley Munoz, an incident response specialist at Kaspersky's Global Emergency Response Team, opens with a practical reason to care about cipher identification: if responders can tell which algorithm a ransomware family used, they may find that a decryptor already exists for a victim. She reviews the basics first, covering symmetric versus asymmetric ciphers, AES block modes such as ECB and CBC, and substitution boxes whose published values make cipher constants recognizable.

The middle of the talk is hands-on. Using the FindCrypt plugin in Ghidra, she locates AES lookup-table constants in a sample. To separate ChaCha20 from Salsa20, she points to the "expand 32-byte k" string and the order of its words. For RSA and ECC, she sets breakpoints on the Windows CryptGenKey call in a debugger, dumps memory, and reads the algorithm ID value, then matches it against Microsoft's documented table, which in her example resolved to 256-bit AES.

Her takeaways are that AES still dominates ransomware file encryption, RSA commonly wraps per-file keys, and hybrid designs trade speed against attacker control. She recommends extracting encryption headers or footers, tracing random number generation, watching for reused constants or seeds across versions, and keeping an internal database of crypto signatures. She closes with a 2024 incident in Mexico, where a strain that used BitLocker to encrypt a server turned out to have a weakness that let the team build a decryptor.