0

Does anyone know why some ransomware families (e.g. Cuba but also Phobos if I am not mistaken) pad the file header to get to 1024 bytes?

I mean what would be a reason for the ransomware developer to not just encrypt the entire file but add padding to get to a certain header size?

Source elastic.co:

Before encrypting a file, Cuba ransomware prepends a 1024 byte header, the first 256 bytes are the string FIDEL.CA and some DWORD bytes values, the next 512 bytes are the encrypted ChaCha20 KEY/IV with the public RSA key and the rest is padded with 0.

I get why they add the FIDEL.CA flag and the key, but why add the additional padding? What's important about the header being 1024 bytes?

enter image description here

1
  • 1
    I think you might kick yourself for not thinking of the answer yourself :)
    – schroeder
    Apr 8, 2023 at 12:49

1 Answer 1

1

It's so that the decryption process knows where to start. If the added header was of a variable length, how would the decryption process know where to remove the added header and where to start decrypting? Without a pre-established header length, the actual header length would have to be recorded somewhere.

So, with a standard header length, the decryption process becomes straightforward: take the first 1024 bytes, check for the flag, grab the key, decrypt the rest of the file.

Yes, other methods could be used, like delimiters, but a pre-established header length is a perfectly fine design pattern to use.

3
  • Thank you and this makes perfectly sense (Indeed I will kick myself :) but just one more question, is there a reason why it´s 1024 bytes? why not 512 for example? I would guess that it´s because it represents exactly 1kB, 1 cluster on default in NTFS? Apr 8, 2023 at 12:59
  • Or, it needs to allow for different key lengths and room for any other data they might want to include
    – schroeder
    Apr 8, 2023 at 13:03
  • @Questions123: Default NTFS cluster size on disks up to 16TB is 4K, not 1K. See Microsoft documentation.
    – mentallurg
    Apr 8, 2023 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .