Unlocked! Recovering files taken hostage by ransomware

We present an analysis of a popular ransomware and tools for recovering encrypted files without access to the official decryptor or key. We're discussing "the second most used ransomware in Germany", encrypting Windows computers and ESXi hosts running virtual machine workloads. Our decryptor-tool exploits a weakness in the cryptographic code in the malware. This weakness allows to (partially) recover encrypted files without access to the decryptor and without needing the cryptographic keys used by the ransomware. We dive into the details of the cryptographic operations used by the malware and explain how it fails to use the cryptographic primitives properly. In particular, the ransomware encrypts victim files using a stream cipher. Files smaller than 5000 bytes are fully encrypted. Larger files are only partially encrypted for efficiency reasons. We found that for larger files, the ransomware re-uses the same cryptographic keystream for encrypting different parts of the same file, thereby breaking the security of the used stream cipher. If the plaintext of any encrypted file part is known, the keystream can be recovered and used to decrypt (large parts of) the target file without the underlying cryptographic key. Affected organisations can check whether the variant of the malware found in their network is susceptible to this attack by purposefully letting the ransomware encrypt a large file (512 MB) containing only zero bytes. If the encrypted parts of the file are identical when analysing the encrypted file (e.g. in a hex editor), recovery is likely possible using the tools presented here. Depending on the encrypted file, parts of the plaintext may be known. For instance, VM disk images are likely to contain stretches of zero bytes. As part of the tooling we have developed, we have implemented a heuristic to detect encrypted zero blocks in encrypted files. If found, (large parts of) the encrypted file can then be recovered. For other types of files, individual plaintext blocks may be recoverable via other means (e.g. using backups or specialised tools), also enabling data recovery. The decryption tools can be found here: https://github.com/srlabs/