0

Does anyone know why some ransomware families (e.g. Cuba but also Phobos if I am not mistaken) pad the file header to get to 1024 bytes?

I mean what would be a reason for the ransomware developer to not just encrypt the entire file but add padding to get to a certain header size?

Source elastic.co:

Before encrypting a file, Cuba ransomware prepends a 1024 byte header, the first 256 bytes are the string FIDEL.CA and some DWORD bytes values, the next 512 bytes are the encrypted ChaCha20 KEY/IV with the public RSA key and the rest is padded with 0.

I get why they add the FIDEL.CA flag and the key, but why add the additional padding? What's important about the header being 1024 bytes?

enter image description here

Improve this question
1
  • 1
    I think you might kick yourself for not thinking of the answer yourself :)
    – schroeder ♦
    Apr 8 at 12:49

1 Answer 1

Reset to default
1

It's so that the decryption process knows where to start. If the added header was of a variable length, how would the decryption process know where to remove the added header and where to start decrypting? Without a pre-established header length, the actual header length would have to be recorded somewhere.

So, with a standard header length, the decryption process becomes straightforward: take the first 1024 bytes, check for the flag, grab the key, decrypt the rest of the file.

Yes, other methods could be used, like delimiters, but a pre-established header length is a perfectly fine design pattern to use.

Improve this answer
3
  • Thank you and this makes perfectly sense (Indeed I will kick myself :) but just one more question, is there a reason why it´s 1024 bytes? why not 512 for example? I would guess that it´s because it represents exactly 1kB, 1 cluster on default in NTFS?
    – Questions123
    Apr 8 at 12:59
  • Or, it needs to allow for different key lengths and room for any other data they might want to include
    – schroeder ♦
    Apr 8 at 13:03
  • @Questions123: Default NTFS cluster size on disks up to 16TB is 4K, not 1K. See Microsoft documentation.
    – mentallurg
    Apr 8 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .