KryBit Ransomware: Encryptor Reversing

Coming soon. This write-up is still being written. Check back shortly; it will be published at this same address.

Reversing a Babuk-derived ransomware encryptor: family confirmation, crypto scheme, recovery inhibition and detections.

What it will cover

• How the family was confirmed from its file extension and mutex rather than AV labels
• The hybrid encryption scheme and the encrypted-file footer layout
• Recovery inhibition, command-line options, share enumeration and exclusion lists
• How the build compares with published Babuk analyses, plus YARA and Sigma rules

Meanwhile

• The case file in my portfolio: https://artfuldodger10.github.io/portfolio/#/case/krybit
• The code, detections and IOCs: krybit-ransomware-analysis