Ransomware

Malware family category that encrypts victim files and demands payment (typically cryptocurrency) for decryption. Often combines symmetric encryption (AES) for files with asymmetric encryption (RSA) for key management, ensuring the attacker alone can provide the decryption key.

Variants Observed in Corpus

• wannacry — AES-128/RSA-2048 worm with SMB propagation via EternalBlue

Capabilities

• file-encryption-aes
• key-management-rsa
• cryptocurrency-payment-demand
• ransom-note-delivery
• shadow-copy-deletion
• recovery-inhibition