Slides:

Part 1

• Implement hybrid encryption
  • Master + Ephemeral Keys
  • Encryption + Decryption
    • String - one program
    • File - one program
    • File - two program
• File System Enumeration
  • Depth or Breadth First Search
  • Print out the files you discover
  • Realize then you want to skip certain folders

• Review the references and slides
  • Apply the techniques to your ransomware

Examples:

• Different encryption strategies
• File System Enumeration (not DFS/BFS)

ransom-osx

• macOS (Go)

BYOR Demo

• Different Encryption Algorithms
• Different File Discovery Strategies
• Different Encryption Strategies (partial/blocks/full)

Conti Ransomware

• Windows (C++)
• Source Code Analysis Video: (https://youtu.be/SGbhqwXB-GU)

Babuk Ransomware

• EXSI (Golang)
• Nas (C)
• Windows (C++)

Windows Ransomware Detection

• Slides: https://github.com/rad9800/talks/blob/main/windows-ransomware-detection.pdf

RansomFS - Ransomware Detection

• Detecting Ransomware using the Projected File System

BootExecute Ransomware