The site: https://www.nomoreransom.org/ offers many decrypter tools for ransomware.

But why?

It shouldn't be so hard to use the Windows Crypto API (e.g. just google "create AES Key in Windows") to create AES Keys, encrypt them with a locally generated public RSA Key and encrypt the corresponding private RSA Key with a Public RSA Key that the attacker controls. (The method of Wanacry.)

If the victim pays the ransom, they have to send the encrypted private RSA key to the attackers, and hopefully get the decrypted private RSA key back.

Why do these people try to reinvent the wheel and in the process make mistakes that allow the development of decrypter tools?

  • 19
    Using the Windows crypto API can trigger antivirus heuristics.
    – forest
    Commented May 15, 2019 at 23:25
  • 103
    Asking why malware isn't quality is like asking why criminal enterprises aren't stellar examples of business management...
    – benxyzzy
    Commented May 16, 2019 at 6:57
  • 3
    Why not encrypt the AES key directly with the public RSA key the attacker controls?
    – lvella
    Commented May 16, 2019 at 10:02
  • 1
    You could do that, but in this case, the victim has to send all the encrypted AES-keys (one for each file) to the attacker, which requires more bandwidth. (Alternatively, the attacker could use a single AES-key for all files.) Remark: What i described was the workflow of Wanacry.
    – kiara
    Commented May 16, 2019 at 11:51
  • 2
    It is all about business common sense . A perfect ransomware crypter will have a risk the the ransomware actor fail to capture the key. There already happens in a few case that the ransomware failure to send the locally generated key back to its hiding place, which damage the reputation and risk future victims willingness to pay. Leaving some "leniency" hole is the best business strategy.
    – mootmoot
    Commented May 17, 2019 at 15:51

4 Answers 4


Disclosure: I work for one of vendors participating in NoMoreRansom.

Most modern ransomware indeed implements proper cryptography. Earlier versions were using rand() for key generation, seeding the random generators with variants of time() - this is why it was important for successful decryption to know when exactly the infection happened; ideally down to minutes. Those could be decrypted with brute force. But most modern ransomware indeed uses either Windows Crypto API, or bundled crypto libraries.

However, no matter how correctly ransomware is implemented, there is always a weak point - to facilitate decryption, the key(s) have to be stored somewhere. This location could be traced by security companies, who would work together with law enforcement to take it over. Access to the server gives the security company the ability to decrypt the ransomware victims files. This is for example the case with GangCrab ransomware.

  • 6
    There is of course the possibility that there is no decryption key. Once the criminals get the ransom, why would they care about repairing the damage done?
    – gnasher729
    Commented May 15, 2019 at 20:54
  • 56
    @gnasher729 people are also lot more likely to pay up if your particular malware has a reputation for following through on decryption. If you never get your files back no ones going to pay. (Sometimes you're right though) Commented May 15, 2019 at 21:39
  • 22
    @gnasher729 I would be more inclined to pay a ransom for my family if the abductors don't have the reputation to kill the hostages anyway ;)
    – Thomas
    Commented May 16, 2019 at 7:47
  • 27
    @Damon If you're talking about third world professional kidnappers that's not really true. There's a whole insurance industry around paying ransoms because those kidnappers want money, they don't want companies to just write off their employees or worse stop sending employees to the country altogether. Commented May 16, 2019 at 13:57
  • 4
    And yes, we know. Chuck Norris and intelligence agencies can track down Tor hidden services, the latter with a few clicks, the former with a roundhouse kick to the screen Commented May 16, 2019 at 15:26

It is just a cost/gain question. Ransomware developers generally do not want to build a security tool with all the involved reviewing. They just want the less expensive tool that will allow them to get more money than it cost. Of course, they are probably breakable, but who cares? Provided some of the first victims have paid what they were asked, the attacker gets much more money than they spent. Furthermore, the longer you use one, the higher the risk to be caught if a governmental security agency manages to come into play.

It is more or less what many real-life thieves do when they manage to enter in a random house: take the most valuable things in the shortest possible time and go away.

Things are different both in the real life and IT world for targetted attacks. If you want to attack a bank or a jewelry shop, the gain is expected to be high enough to spend a lot of preparation time. The same when a governmental service attacks a strategic target, they will use higher quality tools. But it is seldom used for random targets.


The obvious answer is that no criminal would want to interact so directly with their victim.

"send the encrypted private RSA key to the attackers"

requires a consistent point of contact.

In the current model, all the communication is one-way and fungible:

  • malware displays a screen instructing the victim to deposit bitcoins (no direct contact)
  • criminals monitor deposits and send email with key (communication is automated and one-way from any disposable intermediary)

The current model works so well, it is one of the top threats worldwide. There are always ways to improve a system, but if it isn't broken, what's the benefit?

  • 1
    Well, the current model does not work in so many cases. But to your answer: If the attacker only want to communicate one-way, they either have to have a single decryption key for all victims or they have to hard code a individual RSA Public key for every infected machine. However, it would be easy to send the encrypted private key to a server just after the infection. (They usually have to download the ransomware from a server anyway.) Then the decryption can be done automatically as you described.
    – kiara
    Commented May 15, 2019 at 15:56
  • 2
    how is that evidence of it not working?
    – schroeder
    Commented May 15, 2019 at 15:58
  • 2
    The encryption is not messed up. The encryption is fine. The problem is that the key is exposed after people submit the encrypted files and received keys for analysis. When this happens, the criminals just change the keys or even the code base (lots to choose from). There is no error here and nothing to fix.
    – schroeder
    Commented May 15, 2019 at 16:02
  • 1
    "it would be easy to send the encrypted private key to a server just after the infection" - that creates a trail back to the attackers. No criminal would want that, as I said.
    – schroeder
    Commented May 15, 2019 at 16:06
  • 2
    @noɥʇʎԀʎzɐɹƆ Seems like a lot more work and development effort to set up then current established methods. If you are a malware author, you only care to a limited extend if a decryptor gets released eventually - proportionally with how much time you spent making it. You just make another ransomware then
    – Magisch
    Commented May 17, 2019 at 9:41

Frankly, it's pretty tricky to pull off good file encryption and decryption, even with a library that's supposed to do it for you. I tried to modify a cryptor (meant to obfuscate viruses to hide their signatures from antivirus programs) that used a very basic bitshift technique originally, and it didn't work well because most antivirus programs would literally brute force the binary and could realize that it was actually a virus! I wanted to replace the bitshift "encryption", if you could even call it that, with AES encryption via a C# library that I had used successfully in the past for strings, but I could never make it work. Another problem is that the more complicated your encryption algorith is, the longer it takes to sweep the entire disk, and then decrypt at the end when/if they pay. It's also more likely to fail in the middle and result in an incomplete job.

What I saw once on my grandma's computer, back before ransomware really took off and got better, was a ransomware program that supposedly encrypted her files and wanted about $200 to decrypt them. All it did in reality was add the extension ".crypted" to the end of every single file so windows didn't know what program to use to open any of them! Once I figured that out, all that was necessary to do was use the task manager to locate and delete the original ransomware file, then write a batch script to recursively check every file on the system for the .crypted extension and remove it if present. Problem solved within an hour, no money paid to hackers at all! But if they had used AES, this technique wouldn't have worked at all, and deleting the virus file would probably destroy any hope you ever had of cracking the military grade encryption.

The difference is that the guy who used the first technique of renaming the file extension so windows couldn't open any files probably already had hundreds of infections by the time the guy using military grade encryption even finished his virus, and the 5% of people who are smart enough to fix the first one are probably also smart enough to not be infected by the second one. The other 95% of people who couldn't figure out any way to fix either virus other than just paying the ransom, probably paid it the first time (to the guy with the easily breakable ransomware) and then immediately set up a full backup solution to prevent it from ever happening again. If they later got infected by the military grade ransomware, they already learned their lesson once and just restored from the backup. Hopefully even people who haven't been infected yet start to set up backups, so they never even have to pay the ransom once.

From this scenario, you can see how the guy with the easily breakable ransomware can release it first, it acts faster and is more reliable and easier to reverse even if the antivirus program manages to delete the virus before decryption, and because of that, he will make more money than the person who spends tons of time setting up a fully bulletproof ransomware virus, but is later to the market after people have started to wise up and back up their important files.

  • How did you restore the original file extensions? Or did the Ransomware append the .crypted extension to the original filename including the extension? I.e: photo.png.crypted
    – Morgan
    Commented May 18, 2019 at 13:23
  • @Morgan, yes they literally just added the extension ".crypted" to the end of every single file windows would let them modify automatically! Lowest effort ransomware ever, but very easily reversible for both the ransomware itself and for any competent computer user. Unfortunately, probably 80% of computer users are not that competent, and even if they know what role the file extension plays and they don't freak out about the windows warning message you get while changing them, it would take days/weeks to revert them all by hand without a script. Commented Jul 8, 2019 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .