Shulou(Shulou.com)06/01 Report--

Ransomware encryption

spora ransomware encryption method

Description of the above encryption method:

RSA encryption is asymmetric encryption, requiring different public and private keys. AES symmetric encryption, encryption and decryption using the same key.

2 spora ransomware, which generates a pair of RSA public keys, here named host RSA keys, generates an AES key, named host AES keys,

A file-unique AES key is generated for each encrypted file, naming the file AES key.

The key file generated by the spora ransomware consists of a hard-coded RSA public key encrypted host AES and a host AES private key encrypted host AES. The key file needs to be uploaded to *** to be decrypted.

4 Host RSA encrypted file AES key is written to the encrypted file together.

Decryption process:

1 *** Use RSA private key to decrypt hard-coded RSA public key encrypted host AES key to obtain host AES key

2 Use host AES to decrypt the host RSA private key encrypted by host AES to obtain the host RSA private key.

3 Host RSA private key decrypts AES encrypted file by host RSA public key to obtain AES key of file

4 File AES key decrypts the file encrypted by file AES to obtain the decrypted file.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.