Dissecting .NET ransomware: key generation, encryption and operation

Abstract

The threat of ransomware is ever growing. Not all ransomware types are created equal and the cryptosystems in some forms are more virulent than others. This article dissects eight real-world variants belonging to different families of .NET ransomware and provides insights into key generation, encryption and other aspects of the ransomware kill chain. We also summarise ransomware execution flow and dynamic library calls based on the collected evidence. While this analysis was carried out using .NET ransomware samples, the lessons learned from the empirical evidence apply to all modern forms of ransomware and can be used for building more effective ransomware solutions. The threat of ransomware is ever-growing, but not all ransomware types are created equal. The cryptosystems in some forms are more virulent than others. Pranshu Bajpai and Richard Enbody at Michigan State University dissect eight real-world variants belonging to different families of .NET ransomware and provide insights into key generation, encryption and other aspects of the ransomware kill chain. They also summarise ransomware execution flow and the use of dynamic library calls. The lessons learned apply to all forms of ransomware and can be used for building more effective ransomware solutions.