Analyzing Ransomware - Dumping a CryptoAPI Keygen

In this video, we will reverse a ransomware's keygen that uses the Microsoft CryptoAPI and dump the keys from memory.
Sample: www.hybrid-ana...
VirtualBox: www.virtualbox...
PEStudio: www.winitor.com/
IDA Free: www.hex-rays.com/
x64dbg: x64dbg.com/
HxD: mh-nexus.de/en...
More information on the ransomware analyzed: / 1002209455646429186

[@yakovgoldberg7108]

You rock! Thank you for sharing these awesome videos with us.

[@present5343]

Dude you make it seems so easy! Good job

[@beeb490]

you are more than awesome maaaaaaaaaaan

[@Iamrkapoor]

Hi Michael, Thank you for sharing this. I have 2 questions here. 1. So, we could extract the plaintext session key because the cryptexportkey() wasn't using hExpkey (that is using the public key/rsa key to encrypt the session key while exporting) ? 2. Also, in my lab, the malware doesn't create decode.key under windows folder when I step through Createfile(). Any points what could be wrong ?

[@hackfans8143]

Awesome tutorial, but how can I dowload the sample without registering

[@karthikeyankumar4078]

Hi, My xdbg32 not creating decode.txt file in my c windows folder after CreateFileA api, not even encrypting the machine. Anything i needed to be done before

[@bobo-px5gy]

maybe it's about debbugging issues that has already done, or you're using a diff os version !

[@sirreggiereginald2542]

Question for you, since the unencrypted AES key was in memory, would performing memory forensics after the malware is executed possibly lead to key recovery?

[@Demonslay335]

Theoretically, yes, assuming it wasn't properly zero'd from memory. Never had experience with that working personally once the executable has exited and the memory overwritten by another process.

[@jovensotto7701]

Dear Michael, I need ur advise, I was infected by a Virus name: Nemty & Kvag at the same File, pls do help me,.

[@Demonslay335]

Nemty, contact Tesorion CISRT. For Kvag, aka STOP Djvu, read the BleepingComputer support topic FAQ.

[@nathanuchoa9130]

Hello, Michael! How to get Crypto Tester? sorry my english I'm learning, hugs from Brazil.

[@Demonslay335]

I haven't published it yet - it's a tool suite I wrote. I'll make a video highlighting it when it's released. 😉

[@nathanuchoa9130]

@@Demonslay335 thanks, very nice video friend

[@theshiv303]

heh dude, he said sex 3:57

[@rpsingh7558]

with your knowledge one day you will break RSA encryption and ransomware

[@Demonslay335]

That's not how it works... RSA-1024 and above will only be breakable using a quantum computer that is leagues above what's available right now. We're a good 20-30+ years from such a thing.

[@rpsingh7558]

@@Demonslay335 i know sir, but i wish someday it happen

[@rpsingh7558]

i had a txt file in windows folder written public key inside , is it helpful?

[@Demonslay335]

@@rpsingh7558 If it's RSA-1024 or above, no. It's called the RSA factoring problem.

[@rpsingh7558]

@@Demonslay335 thanks but how i know its 1024 or 2096 etc