Extração automatizada de chaves criptográficas em Ransomwares: uma abordagem forense baseada em AOB

Abstract

Ransomware threats have emerged as a primary vector for cyberattacks, with incidence and the complexity of their techniques continuing to grow. Recent reports highlight the significant financial impacts of these attacks, with losses reaching millions of dollars per incident. Ransomware typically employs cryptographic mechanisms to encrypt files on compromised systems, making data recovery contingent on the payment of a ransom, generally associated with the receipt of the cryptographic key or a decryption tool. In this context, this work proposes an automated mechanism for extracting cryptographic keys from ransomware by analyzing volatile memory during malware execution. To gain greater control over the malware’s internal behavior and to enable reproducible experi ments, a custom ransomware sample was developed, inspired by notable strains such as WannaCry and LockBit. The proposed approach leverages AOB (Array of Bytes) signa tures to identify, in real-time, routines related to the generation and temporary storage of cryptographic keys in volatile memory. The experimental process involved static analysis with IDA Free, dynamic memory inspection with Cheat Engine, and the development of an automated tool, AOBTool. The results indicate that the cryptographic key can be located and extracted from memory before it is disposed of, within a timeframe shorter than that required to complete the file encryption process. This highlights the potential of the proposed technique as a valuable support tool for digital forensics and for mitigating ransomware-related incidents.