{"id":11864,"date":"2018-03-27T08:10:11","date_gmt":"2018-03-27T16:10:11","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/03\/27\/news-5633\/"},"modified":"2018-03-27T08:10:11","modified_gmt":"2018-03-27T16:10:11","slug":"news-5633","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/03\/27\/news-5633\/","title":{"rendered":"Encryption 101: Decryptor’s thought process"},"content":{"rendered":"

Credit to Author: Vasilios Hioureas| Date: Tue, 27 Mar 2018 15:00:00 +0000<\/strong><\/p>\n

In the previous parts 1<\/a>, 2<\/a> and 3<\/a> of this series, we covered the basics of encryption, walked through a live example of a ransomware in detail, and talked about encryption weaknesses. In this part of the encryption 101 series, we will begin wrapping it up by going into detail on a ransomware with weak encryption and walking through step-by-step the thought process of creating a decryptor for it.<\/p>\n

This article is intended to help give a malware analyst a starting point for which to build off of in order to reverse and break ransomware encryptions. If nothing more, this article is to serve as an explanation why it is still worth it to inspect ransomware in detail to try to find opportunities for decryption.<\/p>\n

Even though encryption packages and API’s are built into modern day operating systems, still, many malware authors manage to misuse them and give us (analysts) the opportunity to exploit their poor coding skills.<\/p>\n

Target ransomware intro<\/h3>\n

The sample we will be talking about in detail is PrincessLocker. Credit to Hasherezade<\/a> for analyzing and creating keygen and decryptor for this. Her code and information on using the decryptor, should you need to, can be found here:<\/p>\n

Princess Locker decryptor<\/a><\/p>\n

Before continuing on, I greatly urge you to read the analysis report on this ransomware so that you are familiar with some of its inner workings before talking about the decryption. The blog post can be found below:<\/p>\n

\n

PrincessLocker – ransomware with not so royal encryption<\/a><\/p>\n<\/blockquote>\n