skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-ransomware

Analyzes ransomware samples to identify encryption schemes, extract keys, and plan decryption recovery.

64|9|Updated Aug 17, 2026
Search Tags:#ransomware#incident response#sandbox#decryption#malware analysis#key extraction#crypto identification
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-ransomware-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-ransomware
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-ransomware
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-ransomware-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pycryptodome.

What problem does it solve? When files are encrypted by ransomware, analysts need a structured way to identify the encryption algorithm, locate or recover keys, understand C2 key exchange, and determine whether victim files can be decrypted without paying the ransom. ## Core Features & Use Cases - Encryption Identification: Detect ransomware signals (extension changes, ransom notes, high-entropy ciphertext, fixed header/footer key blocks) and classify the scheme as symmetric, asymmetric, or hybrid RSA-wrapped AES. - Key Recovery Workflow: Extract keys statically from binaries, dump them from memory during the encryption loop, or capture C2 key delivery via sandboxed network analysis with INetSim and packet capture. - Decryption & Recovery Planning: Build batch decryption scripts with pycryptodome, restore from VSS/snapper/Time Machine snapshots, or match the family via ID Ransomware and No More Ransom decryptors. - Use Case: A victim's documents were encrypted with a .locker extension and a README ransom note appeared. Use this Skill to fingerprint the AES-plus-RSA hybrid scheme, dump the AES key from memory mid-encryption, and write a verified decryption script. ## Quick Start Analyze this ransomware sample and the encrypted files to identify the encryption algorithm, extract any recoverable keys, and tell me whether decryption is feasible.

Frequently Asked Questions about re-ransomware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify the encryption algorithm used by ransomware?▼

Identify ransomware encryption by fingerprinting constants like AES S-boxes or RSA public key DER blobs in the binary, checking ciphertext block alignment (16 bytes suggests AES), and measuring entropy above 7.0. Static analysis with crypto identification tools comes before any dynamic execution.

How to extract encryption keys from a ransomware sample?▼

Extract ransomware keys statically first via strings, hardcoded values, resources, and import tables. If that fails, dump process memory with gcore while the encryption loop runs and the derived key is still live, or capture C2 key delivery in a sandboxed network.

Can files encrypted by ransomware be decrypted without paying?▼

Decryption without paying is possible when the scheme is symmetric with a recoverable key, when only file headers are encrypted, or when a matching decryptor exists on No More Ransom. Hybrid RSA-wrapped keys without the private key are generally unrecoverable.

Is it safe to run a ransomware sample for analysis?▼

Running ransomware is only safe inside a VM snapshot with network isolation such as INetSim or fake DNS, since execution really encrypts files. Use filesystem snapshots like snapper or VSS, keep original samples read-only on the host, and restore the snapshot immediately after analysis.

Why does a No More Ransom decryptor fail on my files?▼

No More Ransom decryptors fail when the sample is a different variant than the tool covers, since RaaS operators customize algorithms and key schemes per affiliate. Match the exact variant via ID Ransomware and sample hash first, then fall back to key extraction.

Related Skills

Explore More Software Engineering Skills→
DevelopersCoffeeDevelopersCoffee
3

cwe-327-weak-cryptography

Replace weak cryptographic algorithms with secure alternatives in Java code.

Official
Intermediate
woohyun212woohyun212
21

ioc-extract

Extract IPs, domains, URLs, emails, and file hashes from text, logs, or URLs.

Community
Intermediate
YukiIto1999YukiIto1999

analyzing-network-traffic-of-malware

Analyze malware network traffic PCAPs to identify C2 protocols and generate Suricata rules.

Community
Advanced
blamejsblamejs

ransomware-response

Screen sanctions, check decryptors, notify insurers, and test backups during ransomware incidents.

Official
Advanced