The most important thing to keep in mind about ransomware is that the purpose of the creators is to have the victim pay the ransom. From this point of view it is important to note the fact that there are at least three categories of ransomware:
- Typical ransomware, which encrypts files and if victims pay, they receive keys or decryption tools and can recover the files;
- Ransomware that encrypts, destroys or replaces files and even if victims pay, they will never receive their data back (a study from 2016 estimates that 20% of those who pays, don't get their data back);
- Lockers, which do not encrypt files, but prevent people from using their computers by denying access to the desktop, windows explorer, task manager, and other apps, unless they pay a ransom.
Regarding file encryption, which is performed by many variants of ransomware, they typically use a combination of symmetric-key encryption, which is fast(e.g. AES, DES) and asymmetric-key encryption (e.g. RSA).
The symmetric key is usually generated dynamically, and it exists in the memory of the ransomware executable during the encryption process. The asymmetric public key is used to encrypt the symmetric key, and the result is communicated to the creators of the ransomware generally by following the steps in the ransom-related file.
A lot of ransomware use the CryptoAPI library from Windows, but there are also variants which embed the encryption algorithms in the malware code (there are many implementations of these algorithms in different development languages, publicly available).