When you have been "hacked" and you accept to pay for decrypting your encrypted files, how the attacker do the job ?

I understood that a symmetric key is used, itself encrypted by the attacker public key.

  • Is the symmetric key stored locally (victim computer) ?
  • When the user "accepts" to cooperate, what are the technical details concerning decryption ?

Sometimes, the attacker decrypts some few files to prove he can decrypt all the files, but, if the victim has some crypto knowledge, how can the attacker just decrypt some files without revealing the symmectric key : is the decryption process done attacker-side ?


1 Answer 1


It depends on the individual malware, but normally a random symmetric key is generated on the machine (which is used to encrypt the files), which is then encrypted with an asymmetric public key embedded within the application. This encrypted key file is kept locally on the system, but it is useless unless you have the private key to recover the symmetric key.

When the user cooperates, the encrypted key file is given to the bot owner, who can then use their private key to decrypt the symmetric key. This key file and a decryption program is then given back to the user, which then allows them to decrypt their files.

In terms of "proof" of decryption, I'd imagine the user sends the file to the attacker and they decrypt it as proof, rather than providing a single-file decryption program.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .