1

Advanced types of Ransomware generate, usually, an AES 128 bit key (used to encrypt files, some types of ransomware use a unique AES key for each file). This key is generated on the fly. In addition, the ransomware generates a client RSA 4096 bit public/private key pair (again on the fly).The Cpub is used to encrypt the symmetric key; and Cpub itself is encrypted with the RSA public key of the server, which was hardcoded.

However, what I'm wondering is... is the encrypted AES key stored in the file header/trailer (and if the answer is yes... does it overwrite the header/trailer data of the original file)?

I can't find much info on the internet about this, but what I did find:

  • Phobos ransomware stores the AES key in the trailer of the file (including the IV)
  • WannaCry stores the AES key in the header of the file
  • Dharma stores the key in the trailer
Improve this question
4
  • 2
    I'm not sure what answer you expect here. You gave some examples which clearly show that it is specific for the ransomware. Yet you seem to want an answer which encompasses any ransomware. There is simply no significant technical reason to do it in a specific way (header, trailer, spread over the file, separate file ...) . "does it overwrite the header/trailer data of the original file" - Again, no significant technical reason to do it one way or the other. None of this is a feature inherent to how ransomware in general works - it is at most an artifact of how current strains work.
    – Steffen Ullrich
    Commented Oct 9, 2022 at 17:17
  • Steffen I assume you are my number one fanboy hahah, you again :)) The header of an encrypted file has a higher entropy than the header of the original file (even if the original file is compressed, such as a .docx or a .zip for example). So, what I'm looking for is... does the header of an encrypted file have a higher entropy because the key is embedded (since the key is encrypted, it will have a quite uniform distribution of bytes, which leads to a high entropy value), or is it just because the metadata of the original file is encrypted...
    – Moooz
    Commented Oct 9, 2022 at 17:31
  • 1
    Again, you expect a generic answer even you already observed that different ransomware strains behave differently. And again, there is no significant technical reason to do it one way or another. So if your system of detecting ransomware relies on a specific implementation and gains some relevant usage, then ransomware will quickly adopt to do it differently in order to bypass your detection again - as it did it in the past.
    – Steffen Ullrich
    Commented Oct 9, 2022 at 17:45
  • @Moooz if you can distinguish uniform random from AES encryption, then there is a problem with the AES that nobody saw today. Indeed the belief is that AES is a pseudo-random permutation but no one prove that. Here, we assume that the file is IV|AES-KEY|Encrypted FIle
    – kelalaka
    Commented Oct 9, 2022 at 20:23

1 Answer 1

Reset to default
1

is the encrypted AES key stored in the file header/trailer (and if the answer is yes...

Usually. If they use a key per file, storing it within the encrypted file is a quite normal choice.

does it overwrite the header/trailer data of the original file)?

If they expect the original file to be recoverable, the header/trailer data will get prepended/appended. So the encrypted file size will be roughly the size of the original file (once encrypted) plus the size of the encrypted key.

Improve this answer
3
  • Thank you Angel for your answer. In that case, I can analyse the entropy value of the header/trailer, which is (almost by definition) higher than the entropy value of a (e.g.) compressed file, since the key is quite random, and therefore has a low redundancy. Furthermore, the entropy value of an encrypted file would also be higher if the key is not added to the header, as the header of a benign/compressed file is not encrypted (and therefore has a higher redundancy).
    – Moooz
    Commented Oct 9, 2022 at 23:16
  • @Moooz: as noted by kelalaka, you won't find a different value of the entropy of the header/trailer vs the encrypted file (maybe the ransomware is only encrypting part of the file?).
    – Ángel
    Commented Oct 11, 2022 at 1:22
  • If ransomware encrypts the entire file there will be a difference in the entropy values (since it also encrypts the header/trailer, unlike compressed files for example), but (as you already mentioned) I have an issue if the ransomware only encrypts a part of the file (only the content, and not the metadata [header/trailer], then the entropy values will be similar).
    – Moooz
    Commented Oct 12, 2022 at 11:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .