[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG7B5GPVXFKCPDD9C5G66B":3,"skill-same:01M6AG7B5GPVXFKCPDD9C5G66B":161},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":89,"repositoryHtmlUrl":90,"repositoryHomepageUrl":91,"ownerHtmlUrl":92,"ownerBlogUrl":93,"ownerDescription":94,"updatedAt":95,"install":96,"resources":109},"01M6AG7B5GPVXFKCPDD9C5G66B","reverse-engineering-ransomware-encryption-routine",null,"Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities using static and dynamic analysis.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"encryption","reverse engineering ransomware encryption routine","ransomware","engineering","file","verification","reverse-engineering","malware","malware-analysis","validation","routines","cryptanalysis","cryptocurrency","hardening","Tools","aes","rsa","analysis","decryption","cybersecurity","2026-11-10 10:12:30",false,"---\nname: reverse-engineering-ransomware-encryption-routine\ndescription: Reverse engineer ransomware encryption routines to identify cryptographic\n  algorithms, key generation flaws, and potential decryption opportunities using static\n  and dynamic analysis.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- ransomware\n- encryption\n- reverse-engineering\n- cryptanalysis\n- aes\n- rsa\n- decryption\n- malware-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\n- Platform Hardening\n- File Format Verification\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\n- T1486\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - monetization\n  - positioning\n  techniques:\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1047\n    name: Transfer of funds\n    tactic: monetization\n    source: f3\n  - id: T1219\n    name: Remote Access Tools\n    tactic: positioning\n    source: attack\n---\n# Reverse Engineering Ransomware Encryption Routine\n\n## Overview\n\nModern ransomware uses hybrid encryption combining symmetric algorithms (AES-256-CBC\u002FCTR, ChaCha20, Salsa20) for file encryption with asymmetric algorithms (RSA-2048\u002F4096, Curve25519) for key protection. The encryption routine typically generates a random symmetric key per file, encrypts file contents, then encrypts the symmetric key with the attacker's embedded public key. Reverse engineering these routines identifies the specific algorithms, key derivation methods, initialization vectors, file targeting patterns, and potential implementation flaws that could enable decryption without paying the ransom. Notable examples include Rhysida (AES-256-CTR + RSA-4096), Qilin.B (AES-256-CTR with AES-NI or ChaCha20 fallback), and Medusa (AES-256 + RSA).\n\n\n## When to Use\n\n- When performing authorized security testing that involves reverse engineering ransomware encryption routine\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- IDA Pro or Ghidra for static disassembly\n- x64dbg\u002FWinDbg for dynamic debugging\n- Python 3.9+ with `pycryptodome`, `pefile`\n- Understanding of AES, RSA, ChaCha20, Curve25519 algorithms\n- Knowledge of Windows CryptoAPI and CNG (BCrypt) functions\n- Sandbox environment for safe execution\n\n## Key Concepts\n\n### Hybrid Encryption Model\n\nRansomware generates a unique AES key and IV for each file. The file content is encrypted with this symmetric key. The symmetric key is then encrypted with the attacker's RSA public key (embedded in the binary or fetched from C2). The encrypted key is appended or prepended to the encrypted file. Only the attacker holding the RSA private key can decrypt the per-file symmetric keys.\n\n### Cryptographic API Identification\n\nWindows ransomware typically uses CryptoAPI (`CryptAcquireContext`, `CryptGenKey`, `CryptEncrypt`) or CNG (`BCryptGenerateSymmetricKey`, `BCryptEncrypt`). Some use OpenSSL or custom implementations. Identifying these API calls provides immediate insight into the algorithm, key size, and mode of operation.\n\n### Implementation Flaws\n\nDecryption opportunities arise from: hardcoded encryption keys, weak PRNG for key generation (using `GetTickCount` or `time()` as seed), reuse of IVs across files, ECB mode usage, keys remaining in memory post-encryption, and race conditions where keys can be captured during encryption.\n\n## Workflow\n\n### Step 1: Identify Cryptographic Functions\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Identify cryptographic functions in ransomware PE files.\"\"\"\nimport pefile\nimport sys\n\nCRYPTO_APIS = {\n    # Windows CryptoAPI\n    \"CryptAcquireContextA\": \"CryptoAPI context acquisition\",\n    \"CryptAcquireContextW\": \"CryptoAPI context acquisition\",\n    \"CryptGenKey\": \"Key generation\",\n    \"CryptDeriveKey\": \"Key derivation\",\n    \"CryptEncrypt\": \"Encryption operation\",\n    \"CryptDecrypt\": \"Decryption operation\",\n    \"CryptImportKey\": \"Key import (public key?)\",\n    \"CryptExportKey\": \"Key export\",\n    \"CryptGenRandom\": \"Random number generation\",\n    \"CryptCreateHash\": \"Hash creation\",\n    \"CryptHashData\": \"Hashing operation\",\n    # Windows CNG (BCrypt)\n    \"BCryptOpenAlgorithmProvider\": \"CNG algorithm initialization\",\n    \"BCryptGenerateSymmetricKey\": \"CNG symmetric key generation\",\n    \"BCryptEncrypt\": \"CNG encryption\",\n    \"BCryptDecrypt\": \"CNG decryption\",\n    \"BCryptGenerateKeyPair\": \"CNG key pair generation\",\n    \"BCryptImportKeyPair\": \"CNG key import\",\n    # OpenSSL\n    \"EVP_EncryptInit_ex\": \"OpenSSL encrypt init\",\n    \"EVP_EncryptUpdate\": \"OpenSSL encrypt update\",\n    \"EVP_EncryptFinal_ex\": \"OpenSSL encrypt final\",\n    \"RSA_public_encrypt\": \"OpenSSL RSA encryption\",\n    \"AES_set_encrypt_key\": \"OpenSSL AES key setup\",\n    # File operations\n    \"CreateFileW\": \"File open (target files)\",\n    \"ReadFile\": \"File read (before encryption)\",\n    \"WriteFile\": \"File write (after encryption)\",\n    \"FindFirstFileW\": \"File enumeration (targeting)\",\n    \"FindNextFileW\": \"File enumeration\",\n    \"MoveFileW\": \"File rename (extension change)\",\n    \"DeleteFileW\": \"File deletion (originals)\",\n}\n\nAES_SBOX = bytes([\n    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,\n    0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,\n])\n\nCHACHA20_CONSTANT = b\"expand 32-byte k\"\n\n\ndef analyze_imports(filepath):\n    \"\"\"Analyze PE imports for cryptographic APIs.\"\"\"\n    try:\n        pe = pefile.PE(filepath)\n    except pefile.PEFormatError:\n        print(\"[-] Not a valid PE file\")\n        return\n\n    print(\"[+] Cryptographic API Analysis\")\n    print(\"=\" * 60)\n\n    crypto_imports = []\n    if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in pe.DIRECTORY_ENTRY_IMPORT:\n            dll = entry.dll.decode('utf-8', errors='replace')\n            for imp in entry.imports:\n                if imp.name:\n                    name = imp.name.decode('utf-8', errors='replace')\n                    if name in CRYPTO_APIS:\n                        desc = CRYPTO_APIS[name]\n                        crypto_imports.append((dll, name, desc))\n                        print(f\"  [{dll}] {name}: {desc}\")\n\n    if not crypto_imports:\n        print(\"  No known crypto APIs found in imports\")\n        print(\"  Malware may use custom implementation or dynamic loading\")\n\n    return crypto_imports\n\n\ndef find_crypto_constants(filepath):\n    \"\"\"Search for embedded cryptographic constants.\"\"\"\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    print(\"\\n[+] Cryptographic Constants Search\")\n    print(\"=\" * 60)\n\n    # AES S-Box\n    offset = data.find(AES_SBOX)\n    if offset != -1:\n        print(f\"  AES S-Box found at offset 0x{offset:x}\")\n\n    # ChaCha20\u002FSalsa20 constant\n    offset = data.find(CHACHA20_CONSTANT)\n    if offset != -1:\n        print(f\"  ChaCha20 constant at offset 0x{offset:x}\")\n\n    # RSA public key markers\n    rsa_markers = [\n        b'-----BEGIN PUBLIC KEY-----',\n        b'-----BEGIN RSA PUBLIC KEY-----',\n        b'\\x30\\x82',  # ASN.1 SEQUENCE\n    ]\n    for marker in rsa_markers:\n        offset = data.find(marker)\n        if offset != -1:\n            print(f\"  RSA key marker at offset 0x{offset:x}\")\n\n    # Common ransomware file extension patterns\n    import re\n    ext_pattern = re.compile(rb'\\.\\w{3,10}(?=\\x00)', re.IGNORECASE)\n    extensions = set()\n    for match in ext_pattern.finditer(data):\n        ext = match.group().decode('ascii', errors='replace').lower()\n        target_exts = [\n            '.doc', '.docx', '.xls', '.xlsx', '.pdf', '.ppt',\n            '.jpg', '.png', '.sql', '.mdb', '.bak', '.zip',\n        ]\n        if ext in target_exts:\n            extensions.add(ext)\n\n    if extensions:\n        print(f\"\\n  Target file extensions: {', '.join(sorted(extensions))}\")\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cransomware_sample>\")\n        sys.exit(1)\n\n    analyze_imports(sys.argv[1])\n    find_crypto_constants(sys.argv[1])\n```\n\n### Step 2: Analyze Encryption Flow\n\n```python\ndef analyze_encryption_pattern(filepath):\n    \"\"\"Analyze file encryption patterns from ransomware artifacts.\"\"\"\n    import os\n    import struct\n\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    file_size = len(data)\n    print(f\"\\n[+] Encrypted File Analysis: {filepath}\")\n    print(f\"  Size: {file_size:,} bytes\")\n\n    # Check for appended key material (common pattern)\n    # Many ransomware families append encrypted key at end of file\n    tail_sizes = [256, 512, 1024, 2048]  # Common RSA ciphertext sizes\n    for size in tail_sizes:\n        if file_size > size + 16:\n            tail = data[-size:]\n            # High entropy suggests encrypted data\n            entropy = calculate_entropy(tail)\n            if entropy > 7.5:\n                print(f\"  Possible encrypted key ({size} bytes) \"\n                      f\"at end of file (entropy: {entropy:.2f})\")\n\n    # Check for header modifications\n    # Many ransomware prepend metadata\n    header = data[:64]\n    print(f\"  First 16 bytes: {header[:16].hex()}\")\n\n    # Check if original file header is preserved\n    known_headers = {\n        b'PK': 'ZIP\u002FOffice',\n        b'\\x89PNG': 'PNG',\n        b'\\xff\\xd8\\xff': 'JPEG',\n        b'%PDF': 'PDF',\n        b'\\xd0\\xcf\\x11\\xe0': 'OLE (DOC\u002FXLS)',\n    }\n    for magic, ftype in known_headers.items():\n        if header.startswith(magic):\n            print(f\"  Original format preserved: {ftype}\")\n            break\n    else:\n        print(\"  Original header destroyed\u002Fencrypted\")\n\n\ndef calculate_entropy(data):\n    \"\"\"Calculate Shannon entropy of data.\"\"\"\n    from collections import Counter\n    import math\n\n    if not data:\n        return 0\n\n    freq = Counter(data)\n    length = len(data)\n    entropy = -sum(\n        (count \u002F length) * math.log2(count \u002F length)\n        for count in freq.values()\n    )\n    return entropy\n```\n\n## Validation Criteria\n\n- Cryptographic algorithms identified (AES, RSA, ChaCha20, etc.)\n- Key size and mode of operation determined\n- Key generation method analyzed for potential weaknesses\n- Per-file key encryption scheme documented\n- File targeting patterns and extension list extracted\n- Embedded public keys extracted for infrastructure correlation\n- Potential decryption opportunities assessed\n\n## References\n\n- [Morphisec - Breaking Down Ransomware Encryption](https:\u002F\u002Fwww.morphisec.com\u002Fblog\u002Fbreaking-down-ransomware-encryption-key-strategies-algorithms-and-implementation-trends\u002F)\n- [Emsisoft - Ransomware Encryption Methods](https:\u002F\u002Fwww.emsisoft.com\u002Fen\u002Fblog\u002F27649\u002Fransomware-encryption-methods\u002F)\n- [Halcyon Ransomware Power Rankings Q4-2024](https:\u002F\u002Fwww.halcyon.ai\u002Fraas-mq\u002Fpower-rankings-ransomware-malicious-quartile-q4-2024)\n- [No More Ransom Project](https:\u002F\u002Fwww.nomoreransom.org\u002F)\n- [MITRE ATT&CK T1486 - Data Encrypted for Impact](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1486\u002F)\n","# Reverse Engineering Ransomware Encryption Routine\n\n## Overview\n\nModern ransomware uses hybrid encryption combining symmetric algorithms (AES-256-CBC\u002FCTR, ChaCha20, Salsa20) for file encryption with asymmetric algorithms (RSA-2048\u002F4096, Curve25519) for key protection. The encryption routine typically generates a random symmetric key per file, encrypts file contents, then encrypts the symmetric key with the attacker's embedded public key. Reverse engineering these routines identifies the specific algorithms, key derivation methods, initialization vectors, file targeting patterns, and potential implementation flaws that could enable decryption without paying the ransom. Notable examples include Rhysida (AES-256-CTR + RSA-4096), Qilin.B (AES-256-CTR with AES-NI or ChaCha20 fallback), and Medusa (AES-256 + RSA).\n\n\n## When to Use\n\n- When performing authorized security testing that involves reverse engineering ransomware encryption routine\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- IDA Pro or Ghidra for static disassembly\n- x64dbg\u002FWinDbg for dynamic debugging\n- Python 3.9+ with `pycryptodome`, `pefile`\n- Understanding of AES, RSA, ChaCha20, Curve25519 algorithms\n- Knowledge of Windows CryptoAPI and CNG (BCrypt) functions\n- Sandbox environment for safe execution\n\n## Key Concepts\n\n### Hybrid Encryption Model\n\nRansomware generates a unique AES key and IV for each file. The file content is encrypted with this symmetric key. The symmetric key is then encrypted with the attacker's RSA public key (embedded in the binary or fetched from C2). The encrypted key is appended or prepended to the encrypted file. Only the attacker holding the RSA private key can decrypt the per-file symmetric keys.\n\n### Cryptographic API Identification\n\nWindows ransomware typically uses CryptoAPI (`CryptAcquireContext`, `CryptGenKey`, `CryptEncrypt`) or CNG (`BCryptGenerateSymmetricKey`, `BCryptEncrypt`). Some use OpenSSL or custom implementations. Identifying these API calls provides immediate insight into the algorithm, key size, and mode of operation.\n\n### Implementation Flaws\n\nDecryption opportunities arise from: hardcoded encryption keys, weak PRNG for key generation (using `GetTickCount` or `time()` as seed), reuse of IVs across files, ECB mode usage, keys remaining in memory post-encryption, and race conditions where keys can be captured during encryption.\n\n## Workflow\n\n### Step 1: Identify Cryptographic Functions\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Identify cryptographic functions in ransomware PE files.\"\"\"\nimport pefile\nimport sys\n\nCRYPTO_APIS = {\n    # Windows CryptoAPI\n    \"CryptAcquireContextA\": \"CryptoAPI context acquisition\",\n    \"CryptAcquireContextW\": \"CryptoAPI context acquisition\",\n    \"CryptGenKey\": \"Key generation\",\n    \"CryptDeriveKey\": \"Key derivation\",\n    \"CryptEncrypt\": \"Encryption operation\",\n    \"CryptDecrypt\": \"Decryption operation\",\n    \"CryptImportKey\": \"Key import (public key?)\",\n    \"CryptExportKey\": \"Key export\",\n    \"CryptGenRandom\": \"Random number generation\",\n    \"CryptCreateHash\": \"Hash creation\",\n    \"CryptHashData\": \"Hashing operation\",\n    # Windows CNG (BCrypt)\n    \"BCryptOpenAlgorithmProvider\": \"CNG algorithm initialization\",\n    \"BCryptGenerateSymmetricKey\": \"CNG symmetric key generation\",\n    \"BCryptEncrypt\": \"CNG encryption\",\n    \"BCryptDecrypt\": \"CNG decryption\",\n    \"BCryptGenerateKeyPair\": \"CNG key pair generation\",\n    \"BCryptImportKeyPair\": \"CNG key import\",\n    # OpenSSL\n    \"EVP_EncryptInit_ex\": \"OpenSSL encrypt init\",\n    \"EVP_EncryptUpdate\": \"OpenSSL encrypt update\",\n    \"EVP_EncryptFinal_ex\": \"OpenSSL encrypt final\",\n    \"RSA_public_encrypt\": \"OpenSSL RSA encryption\",\n    \"AES_set_encrypt_key\": \"OpenSSL AES key setup\",\n    # File operations\n    \"CreateFileW\": \"File open (target files)\",\n    \"ReadFile\": \"File read (before encryption)\",\n    \"WriteFile\": \"File write (after encryption)\",\n    \"FindFirstFileW\": \"File enumeration (targeting)\",\n    \"FindNextFileW\": \"File enumeration\",\n    \"MoveFileW\": \"File rename (extension change)\",\n    \"DeleteFileW\": \"File deletion (originals)\",\n}\n\nAES_SBOX = bytes([\n    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,\n    0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,\n])\n\nCHACHA20_CONSTANT = b\"expand 32-byte k\"\n\n\ndef analyze_imports(filepath):\n    \"\"\"Analyze PE imports for cryptographic APIs.\"\"\"\n    try:\n        pe = pefile.PE(filepath)\n    except pefile.PEFormatError:\n        print(\"[-] Not a valid PE file\")\n        return\n\n    print(\"[+] Cryptographic API Analysis\")\n    print(\"=\" * 60)\n\n    crypto_imports = []\n    if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in pe.DIRECTORY_ENTRY_IMPORT:\n            dll = entry.dll.decode('utf-8', errors='replace')\n            for imp in entry.imports:\n                if imp.name:\n                    name = imp.name.decode('utf-8', errors='replace')\n                    if name in CRYPTO_APIS:\n                        desc = CRYPTO_APIS[name]\n                        crypto_imports.append((dll, name, desc))\n                        print(f\"  [{dll}] {name}: {desc}\")\n\n    if not crypto_imports:\n        print(\"  No known crypto APIs found in imports\")\n        print(\"  Malware may use custom implementation or dynamic loading\")\n\n    return crypto_imports\n\n\ndef find_crypto_constants(filepath):\n    \"\"\"Search for embedded cryptographic constants.\"\"\"\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    print(\"\\n[+] Cryptographic Constants Search\")\n    print(\"=\" * 60)\n\n    # AES S-Box\n    offset = data.find(AES_SBOX)\n    if offset != -1:\n        print(f\"  AES S-Box found at offset 0x{offset:x}\")\n\n    # ChaCha20\u002FSalsa20 constant\n    offset = data.find(CHACHA20_CONSTANT)\n    if offset != -1:\n        print(f\"  ChaCha20 constant at offset 0x{offset:x}\")\n\n    # RSA public key markers\n    rsa_markers = [\n        b'-----BEGIN PUBLIC KEY-----',\n        b'-----BEGIN RSA PUBLIC KEY-----',\n        b'\\x30\\x82',  # ASN.1 SEQUENCE\n    ]\n    for marker in rsa_markers:\n        offset = data.find(marker)\n        if offset != -1:\n            print(f\"  RSA key marker at offset 0x{offset:x}\")\n\n    # Common ransomware file extension patterns\n    import re\n    ext_pattern = re.compile(rb'\\.\\w{3,10}(?=\\x00)', re.IGNORECASE)\n    extensions = set()\n    for match in ext_pattern.finditer(data):\n        ext = match.group().decode('ascii', errors='replace').lower()\n        target_exts = [\n            '.doc', '.docx', '.xls', '.xlsx', '.pdf', '.ppt',\n            '.jpg', '.png', '.sql', '.mdb', '.bak', '.zip',\n        ]\n        if ext in target_exts:\n            extensions.add(ext)\n\n    if extensions:\n        print(f\"\\n  Target file extensions: {', '.join(sorted(extensions))}\")\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cransomware_sample>\")\n        sys.exit(1)\n\n    analyze_imports(sys.argv[1])\n    find_crypto_constants(sys.argv[1])\n```\n\n### Step 2: Analyze Encryption Flow\n\n```python\ndef analyze_encryption_pattern(filepath):\n    \"\"\"Analyze file encryption patterns from ransomware artifacts.\"\"\"\n    import os\n    import struct\n\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    file_size = len(data)\n    print(f\"\\n[+] Encrypted File Analysis: {filepath}\")\n    print(f\"  Size: {file_size:,} bytes\")\n\n    # Check for appended key material (common pattern)\n    # Many ransomware families append encrypted key at end of file\n    tail_sizes = [256, 512, 1024, 2048]  # Common RSA ciphertext sizes\n    for size in tail_sizes:\n        if file_size > size + 16:\n            tail = data[-size:]\n            # High entropy suggests encrypted data\n            entropy = calculate_entropy(tail)\n            if entropy > 7.5:\n                print(f\"  Possible encrypted key ({size} bytes) \"\n                      f\"at end of file (entropy: {entropy:.2f})\")\n\n    # Check for header modifications\n    # Many ransomware prepend metadata\n    header = data[:64]\n    print(f\"  First 16 bytes: {header[:16].hex()}\")\n\n    # Check if original file header is preserved\n    known_headers = {\n        b'PK': 'ZIP\u002FOffice',\n        b'\\x89PNG': 'PNG',\n        b'\\xff\\xd8\\xff': 'JPEG',\n        b'%PDF': 'PDF',\n        b'\\xd0\\xcf\\x11\\xe0': 'OLE (DOC\u002FXLS)',\n    }\n    for magic, ftype in known_headers.items():\n        if header.startswith(magic):\n            print(f\"  Original format preserved: {ftype}\")\n            break\n    else:\n        print(\"  Original header destroyed\u002Fencrypted\")\n\n\ndef calculate_entropy(data):\n    \"\"\"Calculate Shannon entropy of data.\"\"\"\n    from collections import Counter\n    import math\n\n    if not data:\n        return 0\n\n    freq = Counter(data)\n    length = len(data)\n    entropy = -sum(\n        (count \u002F length) * math.log2(count \u002F length)\n        for count in freq.values()\n    )\n    return entropy\n```\n\n## Validation Criteria\n\n- Cryptographic algorithms identified (AES, RSA, ChaCha20, etc.)\n- Key size and mode of operation determined\n- Key generation method analyzed for potential weaknesses\n- Per-file key encryption scheme documented\n- File targeting patterns and extension list extracted\n- Embedded public keys extracted for infrastructure correlation\n- Potential decryption opportunities assessed\n\n## References\n\n- [Morphisec - Breaking Down Ransomware Encryption](https:\u002F\u002Fwww.morphisec.com\u002Fblog\u002Fbreaking-down-ransomware-encryption-key-strategies-algorithms-and-implementation-trends\u002F)\n- [Emsisoft - Ransomware Encryption Methods](https:\u002F\u002Fwww.emsisoft.com\u002Fen\u002Fblog\u002F27649\u002Fransomware-encryption-methods\u002F)\n- [Halcyon Ransomware Power Rankings Q4-2024](https:\u002F\u002Fwww.halcyon.ai\u002Fraas-mq\u002Fpower-rankings-ransomware-malicious-quartile-q4-2024)\n- [No More Ransom Project](https:\u002F\u002Fwww.nomoreransom.org\u002F)\n- [MITRE ATT&CK T1486 - Data Encrypted for Impact](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1486\u002F)\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"mitre_f3":52,"nist_csf":69,"subdomain":32,"description":7,"mitre_attack":74,"d3fend_techniques":80},[26,24,30,35,39,40,42,32],"mahipal","1.0",{"tactics":53,"version":56,"techniques":57},[54,55],"monetization","positioning","1.1",[58,62,65],{"id":59,"name":60,"source":61,"tactic":54},"F1018","Convert to Cryptocurrency","f3",{"id":63,"name":64,"source":61,"tactic":54},"F1047","Transfer of funds",{"id":66,"name":67,"source":68,"tactic":55},"T1219","Remote Access Tools","attack",[70,71,72,73],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[75,76,77,78,79],"T1027","T1055","T1140","T1497","T1486",[81,82,83,84,85],"File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Freverse-engineering-ransomware-encryption-routine",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":97,"prompt":107,"zipAvailable":108},[98,101,104],{"tool":99,"command":100},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill reverse-engineering-ransomware-encryption-routine",{"tool":102,"command":103},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill reverse-engineering-ransomware-encryption-routine",{"tool":105,"command":106},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill reverse-engineering-ransomware-encryption-routine","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002FSKILL.md",true,[110,116,121,125,131,135,139,143,147,151,157],{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"assets\u002Ftemplate.md","ASSET","资产文件",849,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Fassets\u002Ftemplate.md",{"path":117,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002FLICENSE",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"LICENSE.txt",147,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-content-brief\u002FLICENSE.txt",{"path":126,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Fapi-reference.md","REFERENCE","参考文档",1902,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Freferences\u002Fapi-reference.md",{"path":132,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fexcluded-domains.md",2881,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-content-brief\u002Freferences\u002Fexcluded-domains.md",{"path":136,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fkeyword-density.md",3134,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-content-brief\u002Freferences\u002Fkeyword-density.md",{"path":140,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Fpage-type-templates.md",7174,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-content-brief\u002Freferences\u002Fpage-type-templates.md",{"path":144,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":145,"sourceHtmlUrl":146},"references\u002Fstandards.md",1168,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Freferences\u002Fstandards.md",{"path":148,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":149,"sourceHtmlUrl":150},"references\u002Fworkflows.md",1698,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Freferences\u002Fworkflows.md",{"path":152,"resourceType":153,"resourceTypeDesc":154,"sizeBytes":155,"sourceHtmlUrl":156},"scripts\u002Fagent.py","SCRIPT","脚本",6767,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Fscripts\u002Fagent.py",{"path":158,"resourceType":153,"resourceTypeDesc":154,"sizeBytes":159,"sourceHtmlUrl":160},"scripts\u002Fprocess.py",5561,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Fscripts\u002Fprocess.py",[162,189,211,236,262,289],{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":169,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[168],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[170,171,172,173,174,43,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[197,185,198,199,174,200,43,177,29,201,202,38,203,204,205,206,207,208,209,210],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":221,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[217,220],{"categoryNo":218,"categoryName":219,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[205,222,223,224,225,43,226,33,29,227,228,229,26,36,230,231,232,233,234,235],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","incident-response","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[242],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[244,245,246,43,247,248,249,250,251,252,253,254,255,256,257,258,38,259,260,261],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":263,"name":264,"nameZh":6,"description":265,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":266,"categories":267,"keywords":269,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[268],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[270,271,272,43,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":290,"name":291,"nameZh":6,"description":292,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":293,"categories":294,"keywords":296,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[295],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[174,297,43,298,28,299,300,301,302,303,304,231,305,232,41,306,307,308,309,310],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]