The document discusses how ransomware works by encrypting files on a victim's computer and demanding payment to decrypt the files. It explains the basic process of how ransomware encrypts files, displays a ransom message, and transmits encryption keys to the attacker. The document also provides examples of code that could be used to implement various functions required for a basic ransomware program, such as generating encryption keys, encrypting files, and displaying messages. Finally, it discusses techniques malware developers use to avoid detection by antivirus software.

1. Ransomware for Fun and Non-Pro

2. t
Youness Zougar (@L3tsXpl0it)
zougar92@gmail.com
October 30, 2014
In this paper, I will be explaining how Ransomware works by giving some
examples. This is done for Educational purposes only to understand better
how Ransomware behaves.
1 What is a Ransomware ?
Brie
y, Ransomware is a type of malware created in the aim to restrict
access to a victim's computer by encrypting

3. les on the hard drive. After
that, the victim is asked to pay the attacker to get the restriction removed by
decrypting the encrypted

4. les. CryptoLocker for example is a Ransomware
that infected more than 200K systems in the world, and generated millions
of dollars to its developer.
2 How does it work ?
The process is simple. Generally, when the Ransomware gets executed, it
scans in background all the directories on the system looking for interesting

5. les' extensions (.docx, .xlsx...) that were hard coded in it, then it en-
crypts them using an encryption key. Some Ransomwares block completely
the victims to access the system by changing the Winlogon shell value from
explorer.exe to the the path of the malware executable. At the end, the Ran-
somware pops-up a window asking the victim a ransom to get the decryption
key. To push the victim to pay as fast as possible, some Ransomwares cap-
ture webcam session and use it to freak out the victim.
Now, we have an idea how simple Ransomware works. Let's go deeper
into its functions.
1

6. 3 How Ransomware is made ?
3.1 Scenario
Let's think of a simple Ransomware scenario.
The victim will get the executable on his machine (torrent download, an
infected USB stick...) and launches it. A window will pop-up displaying a
loading bar asking the victim to wait.
In the meantime and in background, all the interesting