[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EZS3CFZ55FWF0G529QXZ2":3,"skill-same:01M71EZS3CFZ55FWF0G529QXZ2":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71EZS3CFZ55FWF0G529QXZ2","malware-family-ransomware",null,"Malware Family Ransomware.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-family-ransomware\u002FSKILL.md",[],[19,20,21,22,23],"malware","ransomware","family","malware family ransomware","cybersecurity","2026-11-10 10:12:30",false,"---\nname: malware-family-ransomware\ndescription: \"Malware Family Ransomware.\"\ndomain: cybersecurity\n---\n\n|\n| **Hybrid Encryption** | Combining symmetric (AES) for fast file encryption with asymmetric (RSA) for secure key wrapping; the standard ransomware approach |\n| **Key Wrapping** | Encrypting the per-file symmetric key with the attacker's RSA public key so only the attacker's private key can decrypt it |\n| **ECB Mode** | Electronic Codebook mode encrypts each block independently; preserves patterns in plaintext, a critical weakness enabling partial recovery |\n| **Known-Plaintext Attack** | Using a known original file and its encrypted version to derive the encryption key; effective against XOR and weak stream ciphers |\n| **Key Schedule** | The expanded form of an AES key in memory; scannable in memory dumps to recover encryption keys before they are erased |\n| **CSPRNG** | Cryptographically Secure Pseudo-Random Number Generator; ransomware using CryptGenRandom produces unpredictable keys |\n| **Partial Encryption** | Some ransomware only encrypts the first N bytes or every Nth block for speed; unencrypted portions may aid recovery |\n\n## Tools & Systems\n\n- **Ghidra**: Reverse engineering suite for analyzing ransomware encryption routines at the assembly level\n- **PyCryptodome**: Python cryptographic library for implementing and testing decryption routines\n- **NoMoreRansom.org**: Free decryption tool repository maintained by Europol and security vendors for known ransomware families\n- **Volatility**: Memory forensics framework for extracting encryption keys from RAM dumps of infected systems\n- **CryptoTester**: Tool for identifying cryptographic algorithms based on constants and code patterns\n\n## Common Scenarios\n\n### Scenario: Assessing Decryption Feasibility for a Ransomware Incident\n\n**Context**: An organization is hit with ransomware encrypting file servers. Management needs to know if decryption is possible without paying the ransom before making a recovery decision.\n\n**Approach**:\n1. Identify the ransomware family from ransom note, file extension, and sample hash (check ID Ransomware)\n2. Check NoMoreRansom.org for existing free decryptors for this family\n3. Reverse engineer the encryption routine in Ghidra to identify the algorithm and key management\n4. Test for implementation weaknesses (key reuse, predictable seeds, ECB mode)\n5. Check if PCAP from the incident captured the key transmission to C2 (if key was sent before encryption)\n6. Scan memory dumps from affected machines for AES key schedules in RAM\n7. Report findings: decryption possible\u002Fimpossible with specific technical justification\n\n**Pitfalls**:\n- Testing decryption methods on the only copy of encrypted files (always work on copies)\n- Assuming all files use the same key without verifying (some ransomware uses per-file keys)\n- Not checking for volume shadow copies (vssadmin) which ransomware may have failed to delete\n- Confusing the file encryption algorithm with the key wrapping algorithm in reports\n\n## Output Format\n\n```\nRANSOMWARE ENCRYPTION ANALYSIS\n================================\nSample:           lockbit3.exe\nFamily:           LockBit 3.0 \u002F LockBit Black\nSHA-256:          abc123def456...\n\nENCRYPTION SCHEME\nFile Cipher:      AES-256-CTR (per-file unique key)\nKey Wrapping:     RSA-2048 (public key embedded in binary)\nKey Generation:   CryptGenRandom (CSPRNG - unpredictable)\nIV Generation:    Random 16 bytes per file\nFile Structure:   [encrypted_data][rsa_encrypted_key(256B)][iv(16B)][magic(8B)]\n\nTARGETED EXTENSIONS\nTotal:            412 extensions targeted\nCategories:       Documents (.doc, .xls, .pdf), Databases (.sql, .mdb),\n                  Archives (.zip, .7z), Source code (.py, .java, .cs)\nExcluded:         .exe, .dll, .sys, .lnk (system files preserved)\n\nIMPLEMENTATION ANALYSIS\nKey Strength:     STRONG - per-file random keys, no reuse\nMode Security:    STRONG - CTR mode with unique nonces\nKey Storage:      RSA-encrypted key appended to each file\nShadow Copies:    Deleted via vssadmin and WMI\n\nDECRYPTION FEASIBILITY\nWithout Key:      NOT POSSIBLE\n  - No implementation flaws identified\n  - RSA-2048 key wrapping prevents brute force\n  - CSPRNG prevents key prediction\n  - No existing free decryptor available\n\nRECOVERY OPTIONS\n1. Restore from offline backups (recommended)\n2. Check for volume shadow copies (low probability - ransomware deletes them)\n3. Memory forensics if machine was not rebooted (key may persist in RAM)\n4. Negotiate with attacker (last resort - no guarantee of decryption)\n```\n","|\n| **Hybrid Encryption** | Combining symmetric (AES) for fast file encryption with asymmetric (RSA) for secure key wrapping; the standard ransomware approach |\n| **Key Wrapping** | Encrypting the per-file symmetric key with the attacker's RSA public key so only the attacker's private key can decrypt it |\n| **ECB Mode** | Electronic Codebook mode encrypts each block independently; preserves patterns in plaintext, a critical weakness enabling partial recovery |\n| **Known-Plaintext Attack** | Using a known original file and its encrypted version to derive the encryption key; effective against XOR and weak stream ciphers |\n| **Key Schedule** | The expanded form of an AES key in memory; scannable in memory dumps to recover encryption keys before they are erased |\n| **CSPRNG** | Cryptographically Secure Pseudo-Random Number Generator; ransomware using CryptGenRandom produces unpredictable keys |\n| **Partial Encryption** | Some ransomware only encrypts the first N bytes or every Nth block for speed; unencrypted portions may aid recovery |\n\n## Tools & Systems\n\n- **Ghidra**: Reverse engineering suite for analyzing ransomware encryption routines at the assembly level\n- **PyCryptodome**: Python cryptographic library for implementing and testing decryption routines\n- **NoMoreRansom.org**: Free decryption tool repository maintained by Europol and security vendors for known ransomware families\n- **Volatility**: Memory forensics framework for extracting encryption keys from RAM dumps of infected systems\n- **CryptoTester**: Tool for identifying cryptographic algorithms based on constants and code patterns\n\n## Common Scenarios\n\n### Scenario: Assessing Decryption Feasibility for a Ransomware Incident\n\n**Context**: An organization is hit with ransomware encrypting file servers. Management needs to know if decryption is possible without paying the ransom before making a recovery decision.\n\n**Approach**:\n1. Identify the ransomware family from ransom note, file extension, and sample hash (check ID Ransomware)\n2. Check NoMoreRansom.org for existing free decryptors for this family\n3. Reverse engineer the encryption routine in Ghidra to identify the algorithm and key management\n4. Test for implementation weaknesses (key reuse, predictable seeds, ECB mode)\n5. Check if PCAP from the incident captured the key transmission to C2 (if key was sent before encryption)\n6. Scan memory dumps from affected machines for AES key schedules in RAM\n7. Report findings: decryption possible\u002Fimpossible with specific technical justification\n\n**Pitfalls**:\n- Testing decryption methods on the only copy of encrypted files (always work on copies)\n- Assuming all files use the same key without verifying (some ransomware uses per-file keys)\n- Not checking for volume shadow copies (vssadmin) which ransomware may have failed to delete\n- Confusing the file encryption algorithm with the key wrapping algorithm in reports\n\n## Output Format\n\n```\nRANSOMWARE ENCRYPTION ANALYSIS\n================================\nSample:           lockbit3.exe\nFamily:           LockBit 3.0 \u002F LockBit Black\nSHA-256:          abc123def456...\n\nENCRYPTION SCHEME\nFile Cipher:      AES-256-CTR (per-file unique key)\nKey Wrapping:     RSA-2048 (public key embedded in binary)\nKey Generation:   CryptGenRandom (CSPRNG - unpredictable)\nIV Generation:    Random 16 bytes per file\nFile Structure:   [encrypted_data][rsa_encrypted_key(256B)][iv(16B)][magic(8B)]\n\nTARGETED EXTENSIONS\nTotal:            412 extensions targeted\nCategories:       Documents (.doc, .xls, .pdf), Databases (.sql, .mdb),\n                  Archives (.zip, .7z), Source code (.py, .java, .cs)\nExcluded:         .exe, .dll, .sys, .lnk (system files preserved)\n\nIMPLEMENTATION ANALYSIS\nKey Strength:     STRONG - per-file random keys, no reuse\nMode Security:    STRONG - CTR mode with unique nonces\nKey Storage:      RSA-encrypted key appended to each file\nShadow Copies:    Deleted via vssadmin and WMI\n\nDECRYPTION FEASIBILITY\nWithout Key:      NOT POSSIBLE\n  - No implementation flaws identified\n  - RSA-2048 key wrapping prevents brute force\n  - CSPRNG prevents key prediction\n  - No existing free decryptor available\n\nRECOVERY OPTIONS\n1. Restore from offline backups (recommended)\n2. Check for volume shadow copies (low probability - ransomware deletes them)\n3. Memory forensics if machine was not rebooted (key may persist in RAM)\n4. Negotiate with attacker (last resort - no guarantee of decryption)\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-family-ransomware","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-family-ransomware",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-family-ransomware",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-family-ransomware","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-family-ransomware\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",500,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-family-ransomware\u002Findex.json",[57,82,105,127,149,165],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,23,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,134,135,136,137,138,139,70,140,23,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,65,158,136,138,159,70,160,140,23,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,65,136,173,159,70,174,175,23,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]